Purpose
Command or Action
Specifies the VLANs to which the IPv6 Snooping policy will be
attached ; enters the VLAN interface configuration mode.
vlan configuration vlan_list
Example:
Switch(config)#
vlan configuration 334
Step 2
Attaches the IPv6 Neighbor Discovery policy to the specified
VLANs across all switch and stack interfaces. The default policy is
attached if the
attach-policy
option is not used.
ipv6 nd inspection
[
attach-policy policy_name
]
Example:
Switch(config-vlan-config)#
ipv6 nd
inspection attach-policy example_policy
Step 3
The default policy is, device-role
host
, no drop-unsecure, limit
address-count disabled, sec-level minimum is disabled, tracking is
disabled, no trusted-port, no validate source-mac.
Confirms that the policy is attached to the specified VLANs without
exiting the configuration mode.
do show running-config
Example:
Switch#(config-if)#
do show
running-config
Step 4
How to Configure an IPv6 Router Advertisement Guard Policy
Beginning in privileged EXEC mode, follow these steps to configure an IPv6 Router Advertisement policy :
SUMMARY STEPS
1.
configure terminal
2.
[
no
]
ipv6 nd raguard policy policy-name
3.
[
no
]
device-role
{
host
|
monitor
|
router
|
switch
}
4.
[
no
]
hop-limit
{
maximum
|
minimum
}
value
5.
[
no
]
managed-config-flag
{
off
|
on
}
6.
[
no
]
match
{
ipv6 access-list list
|
ra prefix-list list
}
7.
[
no
]
other-config-flag
{
on
|
off
}
8.
[
no
]
router-preference maximum
{
high
|
medium
|
low
}
9.
[
no
]
trusted-port
10.
default
{
device-role
|
hop-limit
{
maximum
|
minimum
} |
managed-config-flag
|
match
{
ipv6 access-list
|
ra prefix-list
} |
other-config-flag
|
router-preference maximum
|
trusted-port
}
11.
do show ipv6 nd raguard policy policy_name
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
454
OL-29048-01
Configuring IPv6 First Hop Security
How to Configure an IPv6 Router Advertisement Guard Policy
