Edge-Core AS5700-54X, Cli Reference Manual, Page: 310 / 1116

Chapter 8
| General Security Measures
IPv6 Source Guard
– 310 –
IPv6 Source Guard
IPv6 Source Guard is a security feature that filters IPv6 traffic on non-routed, Layer 2
network interfaces based on manually configured entries in the IPv6 Source Guard
table, or dynamic entries in the Neighbor Discovery Snooping table or DHCPv6
Snooping table when either snooping protocol is enabled (see
“DHCPv6 Snooping”
on page 293 ). IPv6 source guard can be used to prevent traffic attacks caused when
a host tries to use the IPv6 address of a neighbor to access the network. This section
describes commands used to configure IPv6 Source Guard.
ipv6 source-guard
binding
This command adds a static address to the source-guard binding table. Use the no
form to remove a static entry.
Syntax
ipv6 source-guard binding mac-address vlan vlan-id ipv6-address
interface interface
no ipv6 source-guard binding mac-address vlan vlan-id
mac-address - A valid unicast MAC address.
vlan-id - ID of a configured VLAN (Range: 1-4094)
ipv6-address - Corresponding IPv6 address. This address must be entered
according to RFC 2373 “IPv6 Addressing Architecture,” using 8 colon-
separated 16-bit hexadecimal values. One double colon may be used in the
address to indicate the appropriate number of zeros required to fill the
undefined fields.
interface
ethernet unit / port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-32/54)
Table 58: IPv6 Source Guard Commands
Command Function Mode
ipv6 source-guard binding Adds a static address to the source-guard binding table GC
ipv6 source-guard Configures the switch to filter inbound traffic based on
source IP address IC
ipv6 source-guard max-
binding Sets the maximum number of entries that can be bound
to an interface IC
show ipv6 source-guard Shows whether source guard is enabled or disabled on
each interface PE
show ipv6 source-guard
binding Shows the source guard binding table PE