HP 10500 series, Security Configuration Manual

Page: 530 / 596

516
Configuration procedure
To configure ND attack detection:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enter VLAN view.
vlan vlan-id N/A
3. Enable ND attack detection.
ipv6 nd detection enable
By default, ND attack detection is
disabled.
4. Return to system view.
quit N/A
5. Enter Layer 2 Ethernet or
aggregate interface view.
interface
interface-type
interface-number
N/A
6. (Optional.) Configure the
interface as ND trusted
interface.
ipv6 nd detection trust
By default, all interfaces are ND
untrusted interfaces.
Displaying and maintaining ND attack detection
Execute display commands in any view and reset commands in user view.
Task Command
Display statistics for ND messages
dropped by ND attack detection. display ipv6 nd detection statistics [ interface interface-type
interface-number ]
Clear ND attack detection statistics.
reset ipv6 nd detection statistics [ interface interface-type
interface-number ]
Configuring RA guard
About RA guard
RA guard allows Layer 2 access devices to analyze and block unwanted and forged RA messages.
Upon receiving an RA message, the device makes the forwarding or dropping decision based on the
role of the attached device or the RA guard policy.
1. If the role of the device attached to the port is router , the device forwards all RA messages
received on the port. If the role is host , the device directly drops all RA messages received on
the port.
2. If no role is set for the port, the device uses the RA guard policy to match the information found
in the RA message.
{
If the RA message content matches every criterion in the policy, the device forwards the
message.
{
If the RA message content is not validated, the device drops the message.