Cisco Catalyst 2960 Series, Руководство по настройке

Страница: 761 / 2288

do not conform are dropped. An ND message is considered trustworthy if its IPv6-to-Media Access
Control (MAC) mapping is verifiable.
This feature mitigates some of the inherent vulnerabilities of the ND mechanism, such as attacks on
DAD, address resolution, router discovery, and the neighbor cache.
•
IPv6 Router Advertisement Guard
—
The IPv6 Router Advertisement (RA) guard feature enables the
network administrator to block or reject unwanted or rogue RA guard messages that arrive at the network
switch platform. RAs are used by routers to announce themselves on the link. The RA Guard feature
analyzes the RAs and filters out bogus RAs sent by unauthorized routers. In host mode, all router
advertisement and router redirect messages are disallowed on the port. The RA guard feature compares
configuration information on the Layer 2 device with the information found in the received RA frame.
Once the Layer 2 device has validated the content of the RA frame and router redirect frame against the
configuration, it forwards the RA to its unicast or multicast destination. If the RA frame content is not
validated, the RA is dropped.
• IPv6 DHCP Guard — The IPv6 DHCP Guard feature blocks reply and advertisement messages that come
from unauthorized DHCPv6 servers and relay agents. IPv6 DHCP guard can prevent forged messages
from being entered in the binding table and block DHCPv6 server messages when they are received on
ports that are not explicitly configured as facing a DHCPv6 server or DHCP relay. To use this feature,
configure a policy and attach it to an interface or a VLAN. To debug DHCP guard packets, use the
debug ipv6 snooping dhcp-guard
privileged EXEC command.
•
IPv6 Source Guard
—
Like IPv4 Source Guard, IPv6 Source Guard validates the source address or prefix
to prevent source address spoofing.
A source guard programs the hardware to allow or deny traffic based on source or destination addresses.
It deals exclusively with data packet traffic.
The IPv6 source guard feature provides the ability to use the IPv6 binding table to install PACLs to
prevent a host from sending packets with an invalid IPv6 source address.
To debug source-guard packets, use the debug ipv6 snooping source-guard privileged EXEC command.
The IPv6 PACL feature is supported only in the ingress direction; it is not supported in
the egress direction. Note
The following restrictions apply:
◦ An FHS policy cannot be attached to an physical port when it is a member of an EtherChannel
group.
◦ When IPv6 source guard is enabled on a switch port, NDP or DHCP snooping must be enabled on
the interface to which the switch port belongs. Otherwise, all data traffic from this port will be
blocked.
◦ An IPv6 source guard policy cannot be attached to a VLAN. It is supported only at the interface
level.
◦ You cannot use IPv6 Source Guard and Prefix Guard together. When you attach the policy to an
interface, it should be "validate address" or "validate prefix" but not both.
◦ PVLAN and Source/Prefix Guard cannot be applied together.
For more information on IPv6 Source Guard, see the IPv6 Source Guard chapter of the Cisco IOS IPv6
Configuration Guide Library on Cisco.com.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
679
Information about First Hop Security in IPv6