Configuring IPv6 First Hop Security

This chapter describes how to configure First Hop Security (FHS) features on Cisco NX-OS devices.

This chapter includes the following sections:

About First-Hop Security

The Layer 2 and Layer 3 switches operate in the Layer 2 domains with technologies such as server virtualization, Overlay Transport Virtualization (OTV), and Layer 2 mobility. These devices are sometimes referred to as "first hops", specifically when they are facing end nodes. The First-Hop Security feature provides end node protection and optimizes link operations on IPv6 or dual-stack networks.

First-Hop Security (FHS) is a set of features to optimize IPv6 link operation, and help with scale in large L2 domains. These features provide protection from a wide host of rogue or mis-configured users. You can use extended FHS features for different deployment scenarios, or attack vectors.

The following FHS features are supported:

  • IPv6 RA Guard

  • DHCPv6 Guard

  • IPv6 Snooping


Note

See Guidelines and Limitations of First-Hop Security for information about enabling this feature.


Note

Use the feature dhcp command to enable the FHS features on a switch.

IPv6 Global Policies

IPv6 global policies provide storage and access policy database services. IPv6 snooping, DHCPv6 guard, and IPv6 RA guard are IPv6 global policies features. Each time IPv6 snooping, DHCPv6 guard, or RA guard is configured globally, the policy attributes are stored in the software policy database. The policy is then applied to an interface, and the software policy database entry is updated to include this interface to which the policy is applied.

Use the hardware access-list tcam region ing-redirect tcam_size command, to configure FHS. You can resize the ing-racl region to allocate space to the ing-redirect region.

  • Cisco Nexus 9200, 9300-EX, and 9300-FX/FX2 platform switches, FHS packets take the copp-s-dhcpreq queue for software processing.

  • Cisco Nexus 9300, 9500 platform switches, N9K-X9432C-S line card use the class default.


Note

When you upgrade the Cisco Nexus Series switch to Cisco NX-OS Release 7.0(3)I7(1) using the In-Service Software Upgrades (ISSU), you must reload the Cisco NX-OS box before configuring the port level FHS policies.

IPv6 First-Hop Security Binding Table

A database table of IPv6 neighbors connected to the device is created from information sources such as IPv6 snooping. This database, or binding table is used by various IPv6 guard features to validate the link-layer address (LLA), the IPv6 address, and prefix binding of the neighbors to prevent spoofing and redirect attacks.

Guidelines and Limitations of First-Hop Security

The general guidelines and limitations of First-Hop Security are as follows:

  • Before enabling the FHS on the interface or VLAN, we recommend carving TCAM regions on Cisco Nexus 9300 and 9500 Series switches. To enable FHS successfully:

    • On an interface, you must carve the ifacl TCAM region.

    • On a VLAN, you must carve the necessary redirect TCAM region.

    • On a FEX interface, you must carve the fex-ipv6-ifacl TCAM region.

  • Before enabling the FHS, we recommend carving the ing-redirect TCAM region onCisco Nexus 9200, 9300-EX, and 9300-FX/FX2 platform switches.

  • Beginning with Cisco NX-OS Release 9.3(5), FHS is supported on Cisco Nexus 9300-GX switches.

About vPC First-Hop Security Configuration

You can deploy IPv6 First-Hop Security vPC in many ways. We recommend the following best practice deployment scenarios:

  • DHCP relay on-stack

  • DHCP relay on vPC leg

  • DHCP client and relay on orphan ports

DHCP Relay On-stack

In this deployment scenario, you can directly connect clients behind the vPC link, or behind an intermediary switch with DHCP relay running on the Nexus switch. Connecting clients behind an intermediary switch with DHCP relay running on the Nexus switch, is ideal because you can configure the IPv6 Snooping feature on the vPC interface links directly, instead of at a VLAN level. Configuration at the interface level is efficient for the following reasons:

  • Control traffic (DHCP/ND) will not be redirected to CPU for processing on both vPC peers if it goes over the peer link.

  • Packets switched over the peer link aren’t processed a second time.

Figure 1. FHS Configuration with DHCP relay on-stack

In the figure, snooping policy is enabled on both vPC links. In this scenario, the two vPC peers learn all the host IP/MAC bindings behind the vPC links and sync these up between themselves. The two vPC peers learn the bindings using both IPv6 ND and IPv6 DHCP control protocols.

DHCP Relay on VPC Leg

In this configuration, the relay agent does not run on the vPC peers. Instead, the DHCP relay agent (or a DHCP server) is runs behind a vPC link (it can be towards the access, or even somewhere in the core). In such a deployment scenario, the IPv6 Snooping feature doesn’t implicitly trust the DHCP Server messages and drops DHCP Server messages by default. You can customize the IPv6 policy to implement:

  • Security-level glean.

  • IPv6 DHCP Guard policy with device-role server. In this configuration, IPv6 Snooping trusts DHCP server messages attached to the vPC link.

Figure 2. FHS Configuration with external DHCP relay

In the figure, the clients are located behind the vPC links with the default IPv6 snooping policy. You can attach both ipv6 snooping and ipv6 dhcp-guard attach-policy SERVER policies to the links where DHCP server traffic arrives. You will need both the server or relay facing and client facing IPv6 snooping policies to create the client binding entries via DHCP control traffic. This is because IPv6 Snooping needs to see both the client and server packets to create the binding. You must also configure the IPv6 DHCP Guard policy to allow DHCP server traffic by the IPv6 Snooping policy. Both peers require the same configuration because the vPC peers synch all newly learnt client entries learnt on the vPC port.

DHCP Client Relay on Orphan Ports

In this configuration, you can connect the client via an orphan port. The IPv6 Snooping feature only syncs client bindings on vPC ports, but not on orphan ports as these are not directly connected to both vPC peers. In such a configuration, the IPv6 Snooping feature runs independently on both switches. The figure illustrates the following:

  • On the first switch, you must attach the IPv6 Snooping policy on the client facing interface. However, to accommodate DHCP server packets coming from the server on an orphan port behind the vPC peer, you must attach the policy at the VLAN level. In such a case, the policy applied at the VLAN inspects both the client traffic interface and DHCP server traffic. You do not require an individual IPv6 snooping policy per interface. Any DHCP traffic arriving via the vPC peer is also implicitly trusted and if policing is required, the vPC peer automatically drops it.

  • You must also configure IPv6 on the second switch at the VLAN level. You must also configure the IPv6 DHCP Guard policy with a “device-role server” on the server facing orphan port. This prevents the IPv6 Snooping feature from dropping the DHCP server packets. Both switches learn the client binding entries individually and will not sync them, because the client is not on a vPC link.

Figure 3. FHS configuration with client and DHCP relay on orphan port

RA Guard

Overview of IPv6 RA Guard

The IPv6 RA Guard feature provides support for allowing the network administrator to block or reject unwanted or rogue RA guard messages that arrive at the network device platform. RAs are used by devices to announce themselves on the link. The IPv6 RA Guard feature analyzes these RAs and filters out RAs that are sent by unauthorized devices. In host mode, all RA and router redirect messages are disallowed on the port. The RA guard feature compares configuration information on the Layer 2 (L2) device with the information found in the received RA frame. Once the L2 device has validated the content of the RA frame and router redirect frame against the configuration, it forwards the RA to its unicast or multicast destination. If the RA frame content is not validated, the RA is dropped.

IPv6 RA Router Advertisement and the Flags

The Router Advertisement suggests to devices how to create or obtain a global unicast address and other addressing information for communicating on the link. The RA message uses four flags to tell devices how this is to be done:

  1. Address Autoconfiguration flag (A flag): The A flag is enabled by default. This flag tells to hosts on the local link that the specified prefix can be used for IPv6 autoconfiguration.

  2. Other Configuration flag (O flag): The O flag is disabled by default. This flag tells the host to get addressing information other than its global unicast address from a stateless DHCPv6 server. This information may include DNS server addresses and a domain name.

  3. Managed Address Configuration flag (M flag): The M flag is disabled by default. This flag tells a host to use a stateful DHCPv6 server for its global unicast address and all other addressing information. When stateful DHCPv6 is required, use the ipv6 managed-config-flag command to enable the M Flag.


    Note

    When the M flag is enabled, the A flag should usually be disabled. Manually enabling the M flag does not automatically disable the A flag. To disable the A flag, use the ipv6 nd prefix ipv6-prefix/prefix-length no-autoconfig command.

  4. On-Link flag (L flag): The L flag is also enabled by default. The L flag identifies that a specific prefix is on this link or subnet. IPv6 does not perform the Logical AND hashing to determine whether a destination IP address is local to the link as IPv4 does. If the L flag is disabled, every packet is sent to the default gateway. The A flag and the L flag are advertised via ICMPv6 Router Advertisement (RA) by default.

Guidelines and Limitations of IPv6 RA Guard

The guidelines and limitations of IPv6 RA Guard are as follows:

  • The IPv6 RA Guard feature does not offer protection in environments where IPv6 traffic is tunneled.

  • Beginning with Cisco NX-OS Release 10.1(1), IPV6 RA guard is supported on Cisco Nexus 9300-GX platform switches.

  • This feature is supported only in hardware when the ternary content addressable memory (TCAM) is programmed.

  • This feature can be configured on a switch port interface in the ingress direction.

  • This feature supports host mode and router mode.

  • This feature is supported only in the ingress direction; it is not supported in the egress direction.

  • This feature is supported on auxiliary VLANs and private VLANs (PVLANs). In the case of PVLANs, primary VLAN features are inherited and merged with port features.

  • Packets dropped by the IPv6 RA Guard feature can be spanned.

DHCPv6 Guard

Overview of DHCP—DHCPv6 Guard

The DHCPv6 Guard feature blocks DHCP reply and advertisement messages that originate from unauthorized DHCP servers and relay agents that forward DHCP packets from servers to clients. Client messages or messages sent by relay agents from clients to servers are not blocked. The filtering decision is determined by the device role assigned to the receiving switch port, trunk, or VLAN. This functionality helps to prevent traffic redirection or denial of service (DoS).

Packets are classified into one of the three DHCP type messages. All client messages are always switched regardless of device role. DHCP server messages are only processed further if the device role is set to server. Further processing of DHCP server advertisements occurs for server preference checking.

If the device is configured as a DHCP server, all the messages need to be switched, regardless of the device role configuration.

Limitation of DHCPv6 Guard

The guidelines and limitations of DHCPv6 Guard are as follows:

  • If a packet arriving from DHCP server is a Relay Forward or a Relay Reply, only the device role is checked. In addition, IPv6 DHCP Guard doesn't apply the policy for a packet sent out by the local relay agent running on the switch.

IPv6 Snooping

Overview of IPv6 Snooping

IPv6 "snooping," feature bundles several Layer 2 IPv6 first-hop security features, which operates at Layer 2, or between Layer 2 and Layer 3, and provides IPv6 features with security and scalability. This feature mitigates some of the inherent vulnerabilities for the neighbor discovery mechanism, such as attacks on duplicate address detection (DAD), address resolution, device discovery, and the neighbor cache.

IPv6 snooping learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables and analyzes snooping messages in order to build a trusted binding table. IPv6 snooping messages that do not have valid bindings are dropped. An IPv6 snooping message is considered trustworthy if its IPv6-to-MAC mapping is verifiable.

When IPv6 snooping is configured on a target (which varies depending on platform target support and may include device ports, switch ports, Layer 2 interfaces, Layer 3 interfaces, and VLANs), capture instructions are downloaded to the hardware to redirect the snooping protocol and Dynamic Host Configuration Protocol (DHCP) for IPv6 traffic up to the switch integrated security features (SISF) infrastructure in the routing device. For snooping traffic, Neighbor Discovery Protocol (NDP) messages are directed to SISF. For DHCPv6, UDP messages sourced from dhcvp6_client and dhcvp_server ports are redirected.

IPv6 snooping registers its "capture rules" to the classifier, which aggregates all rules from all features on a given target and installs the corresponding ACL down into the platform-dependent modules. Upon receiving redirected traffic, the classifier calls all entry points from any registered feature (for the target on which the traffic is being received), including the IPv6 snooping entry point. This entry point is the last to be called, so any decision (such as drop) made by another feature supersedes the IPv6 snooping decision.

IPv6 snooping provides IPv6 host liveness tracking so that a neighbor table can be immediately updated when an IPv6 host disappears.

Additionally, IPv6 snooping is the foundation for many other IPv6 features that depend on an accurate binding table. It inspects snooping and DHCP messages on a link to glean addresses, and then populates the binding table with these addresses. This feature also enforces address ownership and limits the number of addresses any given node is allowed to claim.

Guidelines and Limitations for IPv6 Snooping

The guidelines and limitations of IPv6 Snooping are as follows:

  • You must perform the same configurations on both the vPC peers. Automatic consistency checker for IPv6 snooping is not supported.

  • The IPv6 Snooping feature is supported only in hardware when the ternary content addressable memory (TCAM) is programed.

  • This feature can be configured on a switch port interface or VLAN only on the ingress port.

  • For IPv6 Snooping to learn DHCP bindings, it must see both server and client replies. A IPv6 snooping policy must be attached to both the client facing the interface (or VLAN) as well as the DHCP server facing interface (or VLAN). In the case of DHCP Relay, an IPv6 Snooping policy must be attached at the VLAN level to see the server replies.

How to Configure IPv6 FHS

Configuring the IPv6 RA Guard Policy on the Device


Note

When the ipv6 nd raguard command is configured on ports, router solicitation messages are not replicated to these ports. To replicate router solicitation messages, all ports that face routers must be set to the router role.

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 2

ipv6 nd raguard policy policy-name

Example:


Device(config)# ipv6 nd raguard policy policy1

Defines the RA guard policy name and enters RA guard policy configuration mode.

Step 3

device-role {host | router | monitor | switch}

Example:


Device(config-raguard-policy)# device-role router

Specifies the role of the device attached to the port.

  • device-role host—Interface or VLAN where you connect a regular node or host. This where you apply the IPV6 RA Guard policy. The device-role host allows incoming RS packets, and blocks incoming RA or RR packets. RS packets that are received on another interface, are not redirected to the device-role host. Only RA and RR packets (that are allowed) are redirected to the device-role host.

  • device-role switch—The device-role switch behaves similar to the device-role host. For example, you can use it as a label for a trunk port.

  • device-role monitor—This device monitors network traffic. It behaves similar to the device-role host, except that RS packets are also sent to this interface. This helps capture traffic.

  • device-role router—Interface that connects to the router. This interface allows incoming RS, RA, or RR packets.

Step 4

hop-limit {maximum | minimum limit}

Example:

Device(config-raguard-policy)# hop-limit minimum 3

(Optional) Enables verification of the advertised hop count limit.

  • If not configured, this check will be bypassed.

Step 5

managed-config-flag {on | off}

Example:

Device(config-raguard-policy)# managed-config-flag on

(Optional) Enables verification that the advertised managed address configuration flag is on.

Note

 

When enabling the M flag, it is recommended to disable the A flag.

  • If not configured, this check will be bypassed.

Step 6

other-config-flag {on | off}

Example:

Device(config-raguard-policy)# other-config-flag on

(Optional) Enables verification of the advertised “other” configuration parameter.

Step 7

router-preference maximum {high | low | medium}

Example:

Device(config-raguard-policy)# router-preference maximum high

(Optional) Enables verification that the advertised default router preference parameter value is lower than or equal to a specified limit.

Step 8

trusted-port

Example:

Device(config-raguard-policy)# trusted-port

(Optional) Specifies that this policy is being applied to trusted ports.

  • All RA guard policing will be disabled.

Step 9

exit

Example:

Device(config-raguard-policy)# exit

Exits RA guard policy configuration mode and returns to global configuration mode.

Configuring IPv6 RA Guard on an Interface

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 2

interface type number

Example:


Device(config)# interface ethernet 1/1

Example:


Device(config)# vlan configuration 10

Specifies an interface type and number, and places the device in interface or VLAN configuration mode.

Step 3

ipv6 nd raguard attach-policy [policy-name ]

Example:


Device(config-if)# ipv6 nd raguard attach-policy

Applies the IPv6 RA Guard feature to a specified interface.

Step 4

exit

Example:

Device(config-if)# exit

Exits interface configuration mode.

Step 5

show ipv6 nd raguard policy [policy-name ]

Example:

switch# show ipv6 nd raguard policy host
Policy host configuration: 
  device-role host

Policy applied on the following interfaces:

  Et0/0        vlan all 
  Et1/0        vlan all

Displays the RA guard policy on all interfaces configured with the RA guard.

Step 6

debug ipv6 snooping raguard [filter | interface | vlanid ]

Example:


Device# debug ipv6 snooping raguard

Enables debugging for IPv6 RA guard snooping information.

Configuring DHCP—DHCPv6 Guard

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 2

ipv6 dhcp guard policy policy-name

Example:


Device(config)# ipv6 dhcp guard policy pol1

Defines the DHCPv6 guard policy name and enters DHCP guard configuration mode.

Step 3

device-role {client | server}

Example:


Device(config-dhcpg-policy)# device-role server

Specifies the device role of the device attached to the target (interface or VLAN).

  • device-role client—Interface where a normal DHCPv6 client is connected. It blocks any incoming server packets.

  • device-role server—Interface where a normal DHCPv6 server is connected. It allows all DHCPv6 packets originating on this interface.

Step 4

preference min limit

Example:


Device(config-dhcpg-policy)# preference min 0

(Optional) Enables verification that the advertised preference (in preference option) is greater than the specified limit. If not specified, this check will be bypassed.

Step 5

preference max limit

Example:


Device(config-dhcpg-policy)# preference max 255

(Optional) Enables verification that the advertised preference (in preference option) is less than the specified limit. If not specified, this check will be bypassed.

Step 6

trusted-port

Example:


Device(config-dhcpg-policy)# trusted-port

(Optional) Specifies that this policy is being applied to trusted ports. All DHCP guard policing will be disabled.

Step 7

exit

Example:


Device(config-dhcpg-policy)# exit

Exits DHCP guard configuration mode and returns to global configuration mode.

Step 8

interface type number

Example:


Device(config)# interface GigabitEthernet 0/2/0

Specifies an interface and enters interface configuration mode.

Step 9

switchport

Example:


Device(config-if)# switchport

Puts an interface that is in Layer 3 mode into Layer 2 mode for Layer 2 configuration.

Step 10

ipv6 dhcp guard [attach-policy policy-name]

Example:


Device(config-if)# ipv6 dhcp guard attach-policy pol1

Attaches a DHCPv6 guard policy to an interface.

Step 11

exit

Example:


Device(config-if)# exit

Exits interface configuration mode and returns to global configuration mode.

Step 12

vlan configuration vlan-id

Example:


Device(config)# vlan configuration 1

Specifies a VLAN and enters VLAN configuration mode.

Step 13

ipv6 dhcp guard [attach-policy policy-name]

Example:


Device(config-vlan-config)# ipv6 dhcp guard attach-policy pol1

Attaches a DHCPv6 guard policy to a VLAN.

Step 14

exit

Example:


Device(config-vlan-config)# exit

Exits VLAN configuration mode and returns to global configuration mode.

Step 15

exit

Example:


Device(config)# exit

Exits global configuration mode and returns to privileged EXEC mode.

Step 16

show ipv6 dhcp guard policy [policy-name]

Example:


Device# show ipv6 dhcp policy guard pol1

(Optional) Displays the policy configuration as well as all the interfaces where the policy is applied.

Configuring IPv6 Snooping

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 2

ipv6 snooping policy policy-name

Example:

Device(config)# ipv6 snooping policy policy1

Configures an IPv6 snooping policy and enters IPv6 snooping configuration mode.

Step 3

device-role { node | switch }

Example:

Device(config-snoop-policy)# device-node switch

Specifies the role of the device attached to the target (interface or VLAN):

  • node—is the default. Bindings are created and entries are probed.

  • switch—Entries are not probed and when a trusted port is enabled, bindings are not created.

Step 4

[no] limit address-count

Example:

Device(config-snoop-policy)# limit address-count 500

Limits the number of binding entries, a no limit address-count means no limit.

Step 5

[no] protocol dhcp | ndp

Example:

Device(config-snoop-policy)# protocol dhcp
Device(config-snoop-policy)# protocol ndp

Turns on or switches off either DHCP or NDP gleaning.

Step 6

trusted-port

Example:

Device(config-snoop-policy)# trusted-port

Specifies that the policy be applied to a trusted port. If an entry is a trusted-port, none of it's traffic will be blocked or dropped.

Step 7

security-level glean | guard | inspect

Example:

Device(config-snoop-policy)# security-level guard

Specifies the type of security applied to the policy: glean, guard, or inspect. Here is what each security level means:

  • glean—learns bindings but does not drop packets.

  • inspect—learns bindings and drops packets in case it detects an issue, such as address theft.

  • guard—works like inspect, but in addition drops IPv6, ND, RA, and IPv6 DHCP Server packets in case of a threat.

Step 8

tracking

Example:

Device(config-snoop-policy)# tracking enable

Enables tracking.

Step 9

exit

Example:

Device(config-snoop-policy)# exit

Exits snooping configuration mode and returns to global configuration mode.

Step 10

interface type-number

Example:

Device(config-if)# interface ethernet 1/25

Specifies an interface and enters interface configuration mode.

Step 11

[no] switchport

Example:

Device(config-if)# switchport

Switches between Layer 2 and Layer 3 mode.

Step 12

ipv6 snooping attach-policy policy-name

Example:

Device(config-if)# ipv6 snooping attach-policy policy1

Attaches the IPv6 snooping policy to an interface.

Step 13

exit

Example:

Device(config-if)# exit

Exits interface configuration mode and returns to global configuration mode.

Step 14

vlan configuration vlan-id

Example:

Device(config)# vlan configuration 333

Specifies a VLAN and enters VLAN configuration mode.

Step 15

ipv6 snooping attach-policy policy-name

Example:

Device(config-vlan-config)# ipv6 snooping attach-policy policy1

Attaches the IPv6 snooping policy to a VLAN.

Step 16

exit

Example:

Device(config-vlan-config)# exit

Exits VLAN configuration mode and returns to global configuration mode.

Step 17

exit

Example:

Device(config)# exit

Exits global configuration mode and returns to privileged EXEC mode.

Step 18

show ipv6 snooping policy policy-name

Example:

Device(config)# show ipv6 snooping policy policy1

Displays the policy configuration and the interfaces where the policy is applied.

Verifying and Troubleshooting IPv6 Snooping

Procedure

  Command or Action Purpose

Step 1

show ipv6 snooping capture-policy [interface type number ]

Example:


Device# show ipv6 snooping capture-policy interface ethernet 0/0

Displays snooping message capture policies.

Step 2

show ipv6 snooping counter [interface type number ]

Example:


Device# show ipv6 snooping counter interface FastEthernet 4/12

Displays information about the packets counted by the interface counter.

Step 3

show ipv6 snooping features

Example:


Device# show ipv6 snooping features

Displays information about snooping features configured on the device.

Step 4

show ipv6 snooping policies [interface type number ]

Example:


Device# show ipv6 snooping policies

Displays information about the configured policies and the interfaces to which they are attached.

Step 5

debug ipv6 snooping

Example:


Device# debug ipv6 snooping

Enables debugging for snooping information in IPv6.

Configuration Examples

Example: IPv6 RA Guard Configuration 


Device(config)# interface ethernet 1/1

Device(config-if)# ipv6 nd raguard attach-policy 

Device# show running-config interface ethernet 1/1
 
Building configuration... 
Current configuration : 129 bytes 
! 
interface ethernet1/1 
 switchport 
 switchport access vlan 222 
 switchport mode access 
 access-group mode prefer port 
 ipv6 nd raguard 
end

Example: Configuring DHCP—DHCPv6 Guard

The following example displays a sample configuration for DHCPv6 Guard: 


configure terminal
ipv6 dhcp guard policy pol1
 device-role server
 preference min 0
 preference max 255
 trusted-port
interface GigabitEthernet 0/2/0
 switchport
 ipv6 dhcp guard attach-policy pol1 
 vlan configuration 1
  ipv6 dhcp guard attach-policy pol1
show ipv6 dhcp guard policy pol1

Example: Configuring IPv6 First-Hop Security Binding Table 


config terminal  
 ipv6 neighbor binding vlan 100 2001:db8::1 interface ethernet3/0
 ipv6 neighbor binding max-entries 100 
 ipv6 neighbor binding logging
 ipv6 neighbor binding retry-interval 8
 exit
show ipv6 neighbor binding

Example: Configuring IPv6 Snooping 

switch (config)# ipv6 snooping policy policy1
switch(config-ipv6-snooping)# ipv6 snooping attach-policy policy1
switch(config-ipv6-snooping)# exit
. 
.
.
Device# show ipv6 snooping policies policy1
Policy policy1 configuration: 
  trusted-port
  device-role node
Policy applied on the following interfaces: 
   Et0/0    			vlan all
   Et1/0       vlan all 
Policy applied on the following vlans: 
   vlan 1-100,200,300-400

Additional References for IPv6 First-Hop Security

This section includes additional information related to configuring IPv6 First-Hop Security.

Related Documents

Related Topic

Document Title

Cisco NX-OS Licensing

Cisco NX-OS Licensing Guide

Command reference

Cisco Nexus 7000 Series NX-OS Security Command Reference