Ruijie RG-S2900G-E Series, Руководство по настройке

Страница: 660 / 943

Configuration Guide ND Snooping Configuration
ND Snooping Configuration
Overview
In the IPv6 network, the network nodes use ND (Neighbor Discovery) protocol to discover router and
carry out auto-configuration, detect duplicate address, translate link-layer address, detect neighbor
accessibility, announce link-layer address change, and redirect route.
Since ND protocol lacks intrinsic security, it is faced with such problems as address resolution attack
and routing information attack, and it's very complicated to increase security by deploying extrinsic
encryption & authentication system. While the stateless address auto-configuration mechanism
realized by ND protocol is bringing about greater convenience to network, IPv6 cannot carry out
effective monitoring of network users.
The ND snooping technology well solves the aforementioned problem.
ND Attack Protection
When using stateless address auto-configuration, the IPv6 node will use Router Advertisement to
configure the IPv6 address of interface, and acquire the prefix of direct-link network segment,
gateway IP address, link MTU and etc. The router can also use ND redirect message to modify the
next hop information of relevant route in the host routing table. Therefore, the attacker may send
invalid RA message and redirect message to modify the routing table of the host being attacked
(such as gateway IP address), so as to implement DoS attack and man-in-the-middle attack. Such
forms of attacks are called "routing information attack".
In order to defend against the aforementioned attacks, ND Snooping divides the interfaces of network
devices into trust interfaces and untrust interfaces. Trust interfaces will be connected with trust nodes
such as Router or server, while untrust interfaces with be connected with untrust nodes such as user
PC. The ND messages received by trust interfaces will be forwarded freely, while redirect messages
and RA messages received by untrust interfaces will be dropped without exception, well avoiding
routing information attack.
If the NA message received by the Untrust interfaces carries information which can only be set by
router (the R bit is set), such message will also be considered invalid.
ND routing information attack protection will always be enabled when ND Snooping is enabled.
ND Snooping and CPP
The security check of ND messages will consume certain CPU resources. In order to prevent the
attacker from implementing DoS attack on network device by sending excessive ND messages, the