Purpose
Command or Action
• device-role switch—The device-role switch behaves
similar to the device-role host. For example, you can
use it as a label for a trunk port.
• device-role monitor—This device monitors network
traffic. It behaves similar to the device-role host, except
that RS packets are also sent to this interface. This
helps capture traffic.
• device-role router—Interface that connects to the
router. This interface allows incoming RS, RA, or RR
packets.
(Optional) Enables verification of the advertised hop count
limit.
hop-limit
{
maximum
|
minimum limit
}
Example:
Step 4
• If not configured, this check will be bypassed.
Device(config-ra-guard)# hop-limit minimum 3
(Optional) Enables verification that the advertised managed
address configuration flag is on.
managed-config-flag
{
on
|
off
}
Example:
Step 5
• If not configured, this check will be bypassed.
Device(config-ra-guard)# managed-config-flag on
(Optional) Enables verification of the advertised “other”
configuration parameter.
other-config-flag
{
on
|
off
}
Example:
Step 6
Device(config-ra-guard)# other-config-flag on
(Optional) Enables verification that the advertised default
router preference parameter value is lower than or equal to
a specified limit.
router-preference maximum
{
high
|
low
|
medium
}
Example:
Device(config-ra-guard)# router-preference maximum
high
Step 7
(Optional) Specifies that this policy is being applied to
trusted ports.
trusted-port
Example:
Step 8
• All RA guard policing will be disabled.
Device(config-ra-guard)# trusted-port
Exits RA guard policy configuration mode and returns to
global configuration mode.
exit
Example:
Step 9
Device(config-ra-guard)# exit
Configuring IPv6 RA Guard on an Interface
SUMMARY STEPS
1.
configure terminal
2.
interface type number
3.
ipv6 nd raguard attach-policy
[
policy-name
]
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
378
Configuring IPv6 First Hop Security
Configuring IPv6 RA Guard on an Interface