How to Configure IPv6 FHS
Configuring the IPv6 RA Guard Policy on the Device
When the
ipv6 nd raguard
command is configured on ports, router solicitation messages are not replicated
to these ports. To replicate router solicitation messages, all ports that face routers must be set to the router
role.
Note
SUMMARY STEPS
1.
configure terminal
2.
ipv6 nd raguard policy policy-name
3.
device-role
{
host
|
router
|
monitor
|
switch
}
4.
hop-limit
{
maximum
|
minimum limit
}
5.
managed-config-flag
{
on
|
off
}
6.
other-config-flag
{
on
|
off
}
7.
router-preference maximum
{
high
|
low
|
medium
}
8.
trusted-port
9.
exit
DETAILED STEPS
Purpose
Command or Action
Enters global configuration mode.
configure terminal
Example:
Step 1
Device# configure terminal
Defines the RA guard policy name and enters RA guard
policy configuration mode.
ipv6 nd raguard policy policy-name
Example:
Step 2
Device(config)# ipv6 nd raguard policy policy1
Specifies the role of the device attached to the port.
device-role
{
host
|
router
|
monitor
|
switch
}
Step 3
Example:
• device-role host—Interface or VLAN where you
connect a regular node or host. This where you apply
Device(config-ra-guard)# device-role router
the IPV6 RA Guard policy. The device-role host allows
incoming RS packets, and blocks incoming RA or RR
packets. RS packets that are received on another
interface, are not redirected to the device-role host.
Only RA and RR packets (that are allowed) are
redirected to the device-role host.
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
377
Configuring IPv6 First Hop Security
How to Configure IPv6 FHS