Copyright Page

Chapter 1. IPv6 RA Guard

Finding Feature Information

Restrictions for IPv6 RA Guard

IPv6 Global Policies

IPv6 RA Guard

Configuring the IPv6 RA Guard Policy on the Device

Configuring IPv6 RA Guard on an Interface

Example: IPv6 RA Guard Configuration

Example: Configuring IPv6 ND Inspection and RA Guard

Additional References

Feature Information for IPv6 RA Guard

Chapter 2. IPv6 Source Guard and Prefix Guard

Finding Feature Information

IPv6 Source Guard Overview

IPv6 Prefix Guard Overview

Configuring IPv6 Source Guard

Configuring IPv6 Source Guard on an Interface

Configuring IPv6 Prefix Guard

Example: Configuring IPv6 Source Guard and Prefix Guard

Additional References for IPv6 Source Guard and Prefix Guard

Feature Information for IPv6 Source Guard and Prefix Guard

Chapter 3. IPv6 Snooping

Finding Feature Information

Restrictions for IPv6 Snooping

Information About IPv6 Snooping

IPv6 Global Policies

IPv6 Neighbor Discovery Inspection

IPv6 ND Inspection

IPv6 Device Tracking

IPv6 First-Hop Security Binding Table

IPv6 Device Tracking

IPv6 Address Glean

Configuring IPv6 ND Inspection

Configuring IPv6 ND Inspection Globally

Applying IPv6 ND Inspection on an Interface

Verifying and Troubleshooting IPv6 ND Inspection

Configuring IPv6 First-Hop Security Binding Table Recovery

Configuring the IPv6 First-Hop Security Binding Table Recovery Mechanism

Configuring Address Gleaning and Associating Recovery Protocols with Prefix Lists

Configuring IPv6 Device Tracking

Configuring IPv6 Prefix Glean

Example: Configuring IPv6 ND Inspection

Example: Configuring IPv6 ND Inspection and RA Guard

Example: Configuring IPv6 Binding Table Content

Example: Configuring IPv6 First-Hop Security Binding Table Recovery

Example: Configuring Address Gleaning and Associating Recovery Protocols with Prefix Lists

Example: Verifying IPv6 Device Tracking

Additional References for IPv6 Source Guard and Prefix Guard

Feature Information for IPv6 Snooping

Chapter 4. IPv6 Router Advertisement Throttler

Finding Feature Information

IPv6 RA Throttler Overview

Scalability Feature: IPv6 RA Throttler

IPv6 RA Throttler Parameter Inheritance

IPv6 RA Throttler Command Precedence Rules

Configuring the IPv6 RA Throttler Policy

Attaching the IPv6 RA Throttler Policy to a VLAN or VLANs

Attaching the IPv6 RA Throttler Policy to a Port

Example: IPv6 RA Throttler Policy Configuration

Example: IPv6 RA Throttler VLAN Configuration

Additional References

Feature Information for IPv6 Router Advertisement Throttler

Chapter 5. IPv6 Neighbor Discovery Multicast Suppress

Finding Feature Information

Restrictions for IPv6 DAD Proxy

Overview of IPv6 Neighbor Discovery Multicast Suppress

Overview of IPv6 DAD Proxy

Configuring IPv6 Neighbor Discovery Multicast Suppress on an Interface

Configuring IPv6 DAD Proxy

Example: Configuring IPv6 Neighbor Discovery Suppress on an Interface

Example: Configuring IPv6 DAD Proxy

Additional References for IPv6 Neighbor Discovery Multicast Suppress

Feature Information for IPv6 Neighbor Discovery Multicast Suppress

Chapter 6. IPv6 Destination Guard

Finding Feature Information

Prerequisites for IPv6 Destination Guard

IPv6 Destination Guard Overview

Configuring IPv6 Destination Guard

Example: Configuring an IPv6 Destination Guard Policy

Additional References

Feature Information for IPv6 Destination Guard

Chapter 7. IPv6 RFCs

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Chapter 1. IPv6 RA Guard

The IPv6 RA Guard feature provides support for allowing the network administrator to block or reject unwanted or rogue router advertisement (RA) guard messages that arrive at the network device platform.

- Finding Feature Information

- Restrictions for IPv6 RA Guard

- Additional References

- Feature Information for IPv6 RA Guard

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Restrictions for IPv6 RA Guard

- The IPv6 RA Guard feature does not offer protection in environments where IPv6 traffic is tunneled.

- This feature is supported only in hardware when the ternary content addressable memory (TCAM) is programmed.

- This feature can be configured on a switch port interface in the ingress direction.

- This feature supports host mode and router mode.

- This feature is supported only in the ingress direction; it is not supported in the egress direction.

- This feature is not supported on EtherChannel and EtherChannel port members.

- This feature is not supported on trunk ports with merge mode.

- This feature is supported on auxiliary VLANs and private VLANs (PVLANs). In the case of PVLANs, primary VLAN features are inherited and merged with port features.

- Packets dropped by the IPv6 RA Guard feature can be spanned.

- If the platform ipv6 acl icmp optimize neighbor-discovery command is configured, the IPv6 RA Guard feature cannot be configured and an error message will be displayed. This command adds default global Internet Control Message Protocol (ICMP) entries that will override the RA guard ICMP entries.

IPv6 Global Policies

IPv6 global policies provide storage and access policy database services. IPv6 ND inspection and IPv6 RA guard are IPv6 global policies features. Every time an ND inspection or RA guard is configured globally, the policy attributes are stored in the software policy database. The policy is then applied to an interface, and the software policy database entry is updated to include this interface to which the policy is applied.

IPv6 RA Guard

The IPv6 RA Guard feature provides support for allowing the network administrator to block or reject unwanted or rogue RA guard messages that arrive at the network device platform. RAs are used by devices to announce themselves on the link. The IPv6 RA Guard feature analyzes these RAs and filters out RAs that are sent by unauthorized devices. In host mode, all RA and router redirect messages are disallowed on the port. The RA guard feature compares configuration information on the Layer 2 (L2) device with the information found in the received RA frame. Once the L2 device has validated the content of the RA frame and router redirect frame against the configuration, it forwards the RA to its unicast or multicast destination. If the RA frame content is not validated, the RA is dropped.

Configuring the IPv6 RA Guard Policy on the Device

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 nd raguard policy policy-name

4.    device-role {host | router}

5.    hop-limit {maximum | minimum limit}

6.    managed-config-flag {on | off}

7.    match ipv6 access-list ipv6-access-list-name

8.    match ra prefix-list ipv6-prefix-list-name

9.    other-config-flag {on | off}

10.    router-preference maximum {high | low | medium}

11.    trusted-port

12.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 nd raguard policy policy-name

Example:

Device(config)# ipv6 nd raguard policy policy1

Defines the RA guard policy name and enters RA guard policy configuration mode.

Step 4

device-role {host | router}

Example:

Device(config-ra-guard)# device-role router

Specifies the role of the device attached to the port.

Step 5

hop-limit {maximum | minimum limit}

Example:

Device(config-ra-guard)# hop-limit minimum 3

(Optional) Enables verification of the advertised hop count limit.

- If not configured, this check will be bypassed.

Step 6

managed-config-flag {on | off}

Example:

Device(config-ra-guard)# managed-config-flag on

(Optional) Enables verification that the advertised managed address configuration flag is on.

- If not configured, this check will be bypassed.

Step 7

match ipv6 access-list ipv6-access-list-name

Example:

Device(config-ra-guard)# match ipv6 access-list list1

(Optional) Enables verification of the sender's IPv6 address in inspected messages from the configured authorized device source access list.

- If not configured, this check will be bypassed.

Step 8

match ra prefix-list ipv6-prefix-list-name

Example:

Device(config-ra-guard)# match ra prefix-list listname1

(Optional) Enables verification of the advertised prefixes in inspected messages from the configured authorized prefix list.

- If not configured, this check will be bypassed.

Step 9

other-config-flag {on | off}

Example:

Device(config-ra-guard)# other-config-flag on

(Optional) Enables verification of the advertised “other” configuration parameter.

Step 10

router-preference maximum {high | low | medium}

Example:

Device(config-ra-guard)# router-preference maximum high

(Optional) Enables verification that the advertised default router preference parameter value is lower than or equal to a specified limit.

Step 11

trusted-port

Example:

Device(config-ra-guard)# trusted-port

(Optional) Specifies that this policy is being applied to trusted ports.

- All RA guard policing will be disabled.

Step 12

exit

Example:

Device(config-ra-guard)# exit

Exits RA guard policy configuration mode and returns to global configuration mode.

Configuring IPv6 RA Guard on an Interface

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    ipv6 nd raguard attach-policy [policy-name [vlan {add | except | none | remove | all} vlan [vlan1, vlan2, vlan3...]]]

5.    exit

6.    show ipv6 nd raguard policy [policy-name]

7.    debug ipv6 snooping raguard [filter | interface | vlanid]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:

Device(config)# interface fastethernet 3/13

Specifies an interface type and number, and places the device in interface configuration mode.

Step 4

ipv6 nd raguard attach-policy [policy-name [vlan {add | except | none | remove | all} vlan [vlan1, vlan2, vlan3...]]]

Example:

Device(config-if)# ipv6 nd raguard attach-policy

Applies the IPv6 RA Guard feature to a specified interface.

Step 5

exit

Example:

Device(config-if)# exit

Exits interface configuration mode.

Step 6

show ipv6 nd raguard policy [policy-name]

Example:

Device# show ipv6 nd raguard policy raguard1

Displays the RA guard policy on all interfaces configured with the RA guard.

Step 7

debug ipv6 snooping raguard [filter | interface | vlanid]

Example:

Device# debug ipv6 snooping raguard

Enables debugging for IPv6 RA guard snooping information.

Example: IPv6 RA Guard Configuration

Device(config)# interface fastethernet 3/13

Device(config-if)# ipv6 nd raguard attach-policy

Device# show running-config interface fastethernet 3/13

Building configuration...
Current configuration : 129 bytes
!
interface FastEthernet3/13
switchport
switchport access vlan 222
switchport mode access
access-group mode prefer port
ipv6 nd raguard
end

Example: Configuring IPv6 ND Inspection and RA Guard

This example provides information about an interface on which both the Neighbor Discovery Inspection and RA Guard features are configured:

Device# show ipv6 snooping capture-policy interface ethernet 0/0

Hardware policy registered on Ethernet 0/0
Protocol     Protocol value   Message   Value     Action    Feature
ICMP         58               RS        85        punt      RA Guard
punt      ND Inspection
ICMP         58               RA        86        drop      RA guard
punt      ND Inspection
ICMP         58               NS        87        punt      ND Inspection
ICM          58               NA        88        punt      ND Inspection
ICMP         58               REDIR     89        drop      RA Guard
punt      ND Inspection

Additional References

Related Documents

Related Topic

Document Title

IPv6 addressing and connectivity

IPv6 Configuration Guide

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

IPv6 commands

Cisco IOS IPv6 Command Reference

Cisco IOS IPv6 features

Cisco IOS IPv6 Feature Mapping

Standards and RFCs

Standard/RFC

Title

RFCs for IPv6

IPv6 RFCs

MIBs

MIB

MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for IPv6 RA Guard

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for IPv6 RA Guard

Feature Name

Releases

Feature Information

IPv6 RA Guard

12.2(33)SXI4

12.2(50)SY

12.2(54)SG

15.0(2)SE

15.0(2)SG

15.2(4)S

15.2(4)M

Cisco IOS XE Release 3.8S

Cisco IOS XE Release 3.2SE

Cisco IOS XE Release 3.2SG

15.2(1)SY

The IPv6 RA Guard feature provides support for allowing the network administrator to block or reject unwanted or rogue router advertisement (RA) guard messages that arrive at the network device platform.

The following commands were introduced or modified: debug ipv6 snooping raguard, device-role, hop-limit, ipv6 nd raguard attach-policy, ipv6 nd raguard policy, managed-config-flag, match ipv6 access-list, match ra prefix-list, other-config-flag, router-preference maximum, show ipv6 nd raguard policy.

Chapter 2. IPv6 Source Guard and Prefix Guard

IPv6 Source Guard and IPv6 Prefix Guard are Layer 2 snooping features that validate the source of IPv6 traffic. IPv6 Source Guard blocks any data traffic from an unknown source. For example, one that is not already populated in the binding table or previously learned through Neighbor Discovery (ND) or Dynamic Host Configuration Protocol (DHCP) gleaning. IPv6 Prefix Guard prevents home-node sourcing traffic outside of the authorized and delegated traffic.

- Finding Feature Information

- Additional References for IPv6 Source Guard and Prefix Guard

- Feature Information for IPv6 Source Guard and Prefix Guard

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

IPv6 Source Guard Overview

IPv6 source guard is an interface feature between the populated binding table and data traffic filtering. This feature enables the device to deny traffic when it is originated from an address that is not stored in the binding table. IPv6 source guard does not inspect ND or DHCP packets; rather, it works in conjunction with IPv6 neighbor discovery (ND) inspection or IPv6 address glean, both of which detect existing addresses on the link and store them into the binding table. IPv6 source guard is an interface between the populated binding table and data traffic filtering, and the binding table must be populated with IPv6 prefixes for IPv6 source guard to work.

IPv6 source guard can deny traffic from unknown sources or unallocated addresses, such as traffic from sources not assigned by a DHCP server. When traffic is denied, the IPv6 address glean feature is notified so that it can try to recover the traffic by querying the DHCP server or by using IPv6 ND. The data-glean function prevents the device and end user from getting deadlocked, whereupon a valid address fails to be stored into the binding table, there is no recovery path, and the end user is unable to connect.

The following illustration provides an overview of how IPv6 source guard works with IPv6 address glean.

IPv6 Source Guard and Address Glean Overview

IPv6 Prefix Guard Overview

The IPv6 Prefix Guard feature works within the IPv6 Source Guard feature, enabling the device to deny traffic originated from nontopologically correct addresses. IPv6 prefix guard is often used when IPv6 prefixes are delegated to devices (for example, home gateways) using DHCP prefix delegation. The feature discovers ranges of addresses assigned to the link and blocks any traffic sourced with an address outside this range.

To determine which prefixes should be allowed and which prefixes should be blocked, IPv6 prefix guard uses the following:

- Prefix glean in Router Advertisements (RAs)

- Prefix glean in DHCP prefix delegation

- Static configuration

Whenever a prefix is to be allowed, IPv6 prefix guard downloads it to the hardware table. Whenever a packet is switched, the hardware matches the source of the packet against this table and drops the packet if no match is found.

The following figure shows a service provider (SP) scenario in which prefixes are gleaned in DHCP-PD messages.

Prefixes Gleaned in DHCP-PD Messages Scenario

Configuring IPv6 Source Guard

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 source-guard policy snooping-policy

4.    permit link-local

5.    deny global-autoconfig

6.    trusted

7.    exit

8.    show ipv6 source-guard policy [snooping-policy]

DETAILED STEPS

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 source-guard policy snooping-policy

Example:

Device(config)# ipv6 source-guard policy

Defines an IPv6 source-guard policy name and enters source-guard policy configuration mode.

Step 4

permit link-local

Example:

Device(config-source-guard)# permit link-local

Allows hardware bridging for all data traffic sourced by a link-local address.

Step 5

deny global-autoconfig

Example:

Device(config-source-guard)# deny global-autoconfig

Denies data traffic from auto-configured global addresses.

Step 6

trusted

Example:

trusted

Step 7

exit

Example:

Device(config-if)# exit

Exits source-guard policy configuration mode and places the device in privileged EXEC mode.

Step 8

show ipv6 source-guard policy [snooping-policy]

Displays the IPv6 source-guard policy configuration.

Configuring IPv6 Source Guard on an Interface

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    ipv6 source-guard attach-policy source-guard-policy

5.    exit

6.    show ipv6 source-guard policy source-guard-policy

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:

Device(config)# interface fastethernet 3/13

Specifies an interface type and number, and enters interface configuration mode.

Step 4

ipv6 source-guard attach-policy source-guard-policy

Example:

Device(config-if)# ipv6 source-guard attach-policy my_source_guard_policy

Applies IPv6 source guard on an interface.

Step 5

exit

Example:

Device(config-if)# exit

Exits interface configuration mode and places the device in privileged EXEC mode.

Step 6

show ipv6 source-guard policy source-guard-policy

Example:

Device# show ipv6 source-guard policy policy1

Displays all the interfaces on which IPv6 source guard is applied.

Configuring IPv6 Prefix Guard

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 source-guard policy snooping-policy

4.    validate address

5.    validate prefix

6.    exit

7.    show ipv6 source-guard policy [snooping-policy]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 source-guard policy snooping-policy

Example:

Device(config)# ipv6 source-guard policy

Defines an IPv6 source-guard policy name and enters source-guard policy configuration mode.

Step 4

validate address

Example:

Device(config-source-guard)# no validate address

Disables the validate address feature and enables the IPv6 prefix guard feature to be configured.

Step 5

validate prefix

Example:

Device(config-source-guard)# validate prefix

Enables IPv6 source guard to perform the IPv6 prefix-guard operation.

Step 6

exit

Example:

Device(config-if)# exit

Exits source-guard policy configuration mode and places the device in privileged EXEC mode.

Step 7

show ipv6 source-guard policy [snooping-policy]

Displays the IPv6 source-guard policy configuration.

Example: Configuring IPv6 Source Guard and Prefix Guard

Device# ipv6 source-guard policy policy1

Policy guard configuration:
validate prefix
validate address

Additional References for IPv6 Source Guard and Prefix Guard

Related Documents

Related Topic

Document Title

IPv6 addressing and connectivity

IPv6 Configuration Guide

IPv4 addressing

IP Addressing: IPv4 Addressing Configuration Guide

Cisco IOS commands

Cisco IOS Master Command List, All Releases

IPv6 commands

Cisco IOS IPv6 Command Reference

Cisco IOS IPv6 features

Cisco IOS IPv6 Feature Mapping

Standards and RFCs

Standard/RFC

Title

RFCs for IPv6

IPv6 RFCs

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for IPv6 Source Guard and Prefix Guard

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for IPv6 Source Guard and Prefix Guard

Feature Name

Releases

Feature Information

IPv6 Prefix Guard

15.3(1)S

15.2(1)E

Cisco IOS XE Release 3.9S

15.2(1)SY

The IPv6 Prefix Guard feature enables a device to deny traffic originated from nontopologically correct addresses.

In Cisco IOS XE Release 3.9S, support was added for the Cisco CSR 1000V

In Cisco IOS XE Release 3.9S, support was added for the Cisco ASR 1000 Series Routers.

The following commands were introduced or modified: ipv6 source-guard policy, permit link-local, show ipv6 source-guard policy, validate address, validate prefix.

IPv6 Source Guard

15.0(2)SE

15.2(1)E

15.3(1)S

Cisco IOS XE Release 3.9S

IOS XE 3.6.0E, IOS 15.2(2)E

The IPv6 source guard feature blocks any data traffic sourced from an unknown source. For example, one that is not already populated in the binding table or previously learned through ND or DHCP gleaning.

In Cisco IOS XE Release 3.9S, support was added for the Cisco CSR 1000V

In Cisco IOS XE Release 3.9S, support was added for the Cisco ASR 1000 Series Routers.

The following commands were introduced or modified: deny global-autoconfig, ipv6 source-guard attach-policy, ipv6 source-guard policy, permit link-local, show ipv6 source-guard policy, trusted.

Chapter 3. IPv6 Snooping

The IPv6 Snooping feature bundles several Layer 2 IPv6 first-hop security features, including IPv6 neighbor discovery inspection, IPv6 device tracking, IPv6 address glean, and IPv6 binding table recovery, to provide security and scalability. IPv6 ND inspection operates at Layer 2, or between Layer 2 and Layer 3, to provide IPv6 functions with security and scalability.

- Finding Feature Information

- Restrictions for IPv6 Snooping

- Information About IPv6 Snooping

- Additional References for IPv6 Source Guard and Prefix Guard

- Feature Information for IPv6 Snooping

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Restrictions for IPv6 Snooping

The IPv6 snooping feature is not supported on Etherchannel ports.

Information About IPv6 Snooping

- IPv6 Global Policies

- IPv6 Neighbor Discovery Inspection

IPv6 Global Policies

IPv6 global policies provide storage and access policy database services. IPv6 ND inspection and IPv6 RA guard are IPv6 global policies features. Every time an ND inspection or RA guard is configured globally, the policy attributes are stored in the software policy database. The policy is then applied to an interface, and the software policy database entry is updated to include this interface to which the policy is applied.

IPv6 Neighbor Discovery Inspection

The IPv6 Neighbor Discovery Inspection, or IPv6 "snooping," feature bundles several Layer 2 IPv6 first-hop security features, including IPv6 Address Glean and IPv6 Device Tracking. IPv6 neighbor discovery (ND) inspection operates at Layer 2, or between Layer 2 and Layer 3, and provides IPv6 features with security and scalability. This feature mitigates some of the inherent vulnerabilities for the neighbor discovery mechanism, such as attacks on duplicate address detection (DAD), address resolution, device discovery, and the neighbor cache.

IPv6 ND inspection learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables and analyzes ND messages in order to build a trusted binding table. IPv6 ND messages that do not have valid bindings are dropped. An ND message is considered trustworthy if its IPv6-to-MAC mapping is verifiable.

When IPv6 ND inspection is configured on a target (which varies depending on platform target support and may include device ports, switch ports, Layer 2 interfaces, Layer 3 interfaces, and VLANs), capture instructions are downloaded to the hardware to redirect the ND protocol and Dynamic Host Configuration Protocol (DHCP) for IPv6 traffic up to the switch integrated security features (SISF) infrastructure in the routing device. For ND traffic, messages such as NS, NA, RS, RA, and REDIRECT are directed to SISF. For DHCP, UDP messages sourced from port 546 or 547 are redirected.

IPv6 ND inspection registers its "capture rules" to the classifier, which aggregates all rules from all features on a given target and installs the corresponding ACL down into the platform-dependent modules. Upon receiving redirected traffic, the classifier calls all entry points from any registered feature (for the target on which the traffic is being received), including the IPv6 ND inspection entry point. This entry point is the last to be called, so any decision (such as drop) made by another feature supersedes the IPv6 ND inspection decision.

- IPv6 ND Inspection

- IPv6 Device Tracking

- IPv6 Address Glean

IPv6 ND Inspection

IPv6 ND inspection learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables. IPv6 ND inspection analyzes neighbor discovery messages in order to build a trusted binding table database, and IPv6 neighbor discovery messages that do not have valid bindings are dropped. A neighbor discovery message is considered trustworthy if its IPv6-to-MAC mapping is verifiable.

This feature mitigates some of the inherent vulnerabilities for the neighbor discovery mechanism, such as attacks on duplicate address detection (DAD), address resolution, device discovery, and the neighbor cache.

IPv6 Device Tracking

IPv6 device tracking provides IPv6 host liveness tracking so that a neighbor table can be immediately updated when an IPv6 host disappears.

- IPv6 First-Hop Security Binding Table

- IPv6 Device Tracking

IPv6 First-Hop Security Binding Table

The IPv6 First-Hop Security Binding Table recovery mechanism feature enables the binding table to recover in the event of a device reboot. A database table of IPv6 neighbors connected to the device is created from information sources such as ND snooping. This database, or binding, table is used by various IPv6 guard features to validate the link-layer address (LLA), the IPv4 or IPv6 address, and prefix binding of the neighbors to prevent spoofing and redirect attacks.

This mechanism enables the binding table to recover in the event of a device reboot. The recovery mechanism will block any data traffic sourced from an unknown source; that is, a source not already specified in the binding table and previously learned through ND or DHCP gleaning. This feature recovers the missing binding table entries when the resolution for a destination address fails in the destination guard. When a failure occurs, a binding table entry is recovered by querying the DHCP server or the destination host, depending on the configuration.

- Recovery Protocols and Prefix Lists

Recovery Protocols and Prefix Lists

The IPv6 First-Hop Security Binding Table Recovery Mechanism feature introduces the capability to provide a prefix list that is matched before the recovery is attempted for both DHCP and NDP.

If an address does not match the prefix list associated with the protocol, then the recovery of the binding table entry will not be attempted with that protocol. The prefix list should correspond to the prefixes that are valid for address assignment in the Layer 2 domain using the protocol. The default is that there is no prefix list, in which case the recovery is attempted for all addresses. The command to associate a prefix list to a protocol is protocol {dhcp | ndp} [prefix-list prefix-list-name].

IPv6 Device Tracking

IPv6 device tracking provides IPv6 host liveness tracking so that a neighbor table can be immediately updated when an IPv6 host disappears.

IPv6 Address Glean

IPv6 address glean is the foundation for many other IPv6 features that depend on an accurate binding table. It inspects ND and DHCP messages on a link to glean addresses, and then populates the binding table with these addresses. This feature also enforces address ownership and limits the number of addresses any given node is allowed to claim.

The following figure shows how IPv6 address glean works.

IPv6 Address Glean

Configuring IPv6 ND Inspection

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 snooping policy snooping-policy

4.    ipv6 snooping attach-policy snooping-policy

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 snooping policy snooping-policy

Example:

Device(config)# ipv6 snooping policy policy1

Configures an IPv6 snooping policy and enters IPv6 snooping configuration mode.

Step 4

ipv6 snooping attach-policy snooping-policy

Example:

Device(config-ipv6-snooping)# ipv6 snooping attach-policy policy1

Attaches the IPv6 snooping policy to a target.

- Configuring IPv6 ND Inspection Globally

- Applying IPv6 ND Inspection on an Interface

- Verifying and Troubleshooting IPv6 ND Inspection

Configuring IPv6 ND Inspection Globally

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 nd inspection policy policy-name

4.    drop-unsecure

5.    sec-level minimum value

6.    device-role {host | monitor | router}

7.    tracking {enable [reachable-lifetime {value | infinite}] | disable [stale-lifetime {value | infinite}]}

8.    trusted-port

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 nd inspection policy policy-name

Example:

Device(config)# ipv6 nd inspection policy policy1

Defines the ND inspection policy name and enters ND inspection policy configuration mode.

Step 4

drop-unsecure

Example:

Device(config-nd-inspection)# drop-unsecure

Drops messages with no options, invalid options, or an invalid signature.

Step 5

sec-level minimum value

Example:

Device(config-nd-inspection)# sec-level minimum 2

Specifies the minimum security level parameter value when cryptographically generated address (CGA) options are used.

Step 6

device-role {host | monitor | router}

Example:

Device(config-nd-inspection)# device-role monitor

Specifies the role of the device attached to the port.

Step 7

tracking {enable [reachable-lifetime {value | infinite}] | disable [stale-lifetime {value | infinite}]}

Example:

Device(config-nd-inspection)# tracking disable stale-lifetime infinite

Overrides the default tracking policy on a port.

Step 8

trusted-port

Example:

Device(config-nd-inspection)# trusted-port

Configures a port to become a trusted port.

Applying IPv6 ND Inspection on an Interface

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    ipv6 nd inspection [attach-policy [policy policy-name] | vlan {add | except | none | remove | all} vlan [vlan1, vlan2, vlan3...]]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:

Device(config)# interface fastethernet 0/0

Specifies an interface type and number and enters interface configuration mode.

Step 4

ipv6 nd inspection [attach-policy [policy policy-name] | vlan {add | except | none | remove | all} vlan [vlan1, vlan2, vlan3...]]

Example:

Device(config-if)# ipv6 nd inspection

Applies the ND Inspection feature on the interface.

Verifying and Troubleshooting IPv6 ND Inspection

SUMMARY STEPS

1.    enable

2.    show ipv6 snooping capture-policy [interface type number]

3.    show ipv6 snooping counter [interface type number]

4.    show ipv6 snooping features

5.    show ipv6 snooping policies [interface type number]

6.    debug ipv6 snooping

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

show ipv6 snooping capture-policy [interface type number]

Example:

Device# show ipv6 snooping capture-policy interface ethernet 0/0

Displays snooping ND message capture policies.

Step 3

show ipv6 snooping counter [interface type number]

Example:

Device# show ipv6 snooping counter interface FastEthernet 4/12

Displays information about the packets counted by the interface counter.

Step 4

show ipv6 snooping features

Example:

Device# show ipv6 snooping features

Displays information about snooping features configured on the device.

Step 5

show ipv6 snooping policies [interface type number]

Example:

Device# show ipv6 snooping policies

Displays information about the configured policies and the interfaces to which they are attached.

Step 6

debug ipv6 snooping

Example:

Device# debug ipv6 snooping

Enables debugging for snooping information in IPv6.

Configuring IPv6 First-Hop Security Binding Table Recovery

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 neighbor binding vlan vlan-id {interface type number | ipv6-address | mac-address} [tracking [disable | enable | retry-interval value] | reachable-lifetime value]

4.    ipv6 neighbor binding max-entries entries [vlan-limit number | interface-limit number | mac-limit number]

5.    ipv6 neighbor binding logging

6.    exit

7.    show ipv6 neighbor binding [vlan vlan-id | interface type number | ipv6 ipv6-address | mac mac-address]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 neighbor binding vlan vlan-id {interface type number | ipv6-address | mac-address} [tracking [disable | enable | retry-interval value] | reachable-lifetime value]

Example:

Device(config)# ipv6 neighbor binding vlan 100 interface Ethernet 0/0 reachable-lifetime 100

Adds a static entry to the binding table database.

Step 4

ipv6 neighbor binding max-entries entries [vlan-limit number | interface-limit number | mac-limit number]

Example:

Device(config)# ipv6 neighbor binding max-entries 100

Specifies the maximum number of entries that are allowed to be inserted in the binding table cache.

Step 5

ipv6 neighbor binding logging

Example:

Device(config)# ipv6 neighbor binding logging

Enables the logging of binding table main events.

Step 6

exit

Example:

Device(config)# exit

Exits global configuration mode and enters privileged EXEC mode.

Step 7

show ipv6 neighbor binding [vlan vlan-id | interface type number | ipv6 ipv6-address | mac mac-address]

Example:

Device# show ipv6 neighbor binding

Displays the contents of a binding table.

- Configuring the IPv6 First-Hop Security Binding Table Recovery Mechanism

- Configuring Address Gleaning and Associating Recovery Protocols with Prefix Lists

Configuring the IPv6 First-Hop Security Binding Table Recovery Mechanism

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 neighbor binding vlan vlan-id ipv6-address interface type number

4.    ipv6 prefix-list list-name permit ipv6-prefix/prefix-length ge ge-value

5.    ipv6 snooping policy snooping-policy-id

6.    destination-glean {recovery | log-only} [dhcp]

7.    protocol dhcp [prefix-list prefix-list-name]

8.    exit

9.    ipv6 destination-guard policy policy-name

10.    enforcement {always | stressed}

11.    exit

12.    ipv6 dhcp guard policy policy-name

13.    device-role server

14.    exit

15.    vlan configuration vlan-list-id

16.    ipv6 snooping attach-policy policy-name

17.    ipv6 destination-guard attach-policy policy-name

18.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 neighbor binding vlan vlan-id ipv6-address interface type number

Example:

Device(config)# ipv6 neighbor binding vlan 100 2001:db8::1 interface ethernet3/0

Adds a static entry to the binding table database.

Step 4

ipv6 prefix-list list-name permit ipv6-prefix/prefix-length ge ge-value

Example:

Device(config)# ipv6 prefix-list abc permit 2001:DB8::/64 ge 128

Creates an entry in an IPv6 prefix list.

Step 5

ipv6 snooping policy snooping-policy-id

Example:

Device(config)# ipv6 snooping policy xyz

Enters IPv6 snooping configuration mode and allows you to modify the configuration of the snooping policy specified.

Step 6

destination-glean {recovery | log-only} [dhcp]

Example:

Device(config-ipv6-snooping)# destination-glean recovery dhcp

Specifies that destination addresses should be recovered from DHCP.

Note:
If logging (without recovery) is required, use the destination-glean log-only command.

Step 7

protocol dhcp [prefix-list prefix-list-name]

Example:

Device(config-ipv6-snooping)# protocol dhcp prefix-list abc

(Optional) Specifies that addresses should be gleaned with DHCP and associates the protocol with a specific IPv6 prefix list.

Step 8

exit

Example:

Device(config-ipv6-snooping)# exit

Exits IPv6 snooping configuration mode and returns to global configuration mode.

Step 9

ipv6 destination-guard policy policy-name

Example:

Device(config)# ipv6 destination-guard policy xyz

(Optional) Enters destination guard configuration mode and allows you to modify the configuration of the specified destination guard policy.

Step 10

enforcement {always | stressed}

Example:

Device(config-destguard)# enforcement stressed

Sets the enforcement level of the policy to be either enforced under all conditions or only when the system is under stress.

Step 11

exit

Example:

Device(config-destguard)# exit

Exits destination guard configuration mode and returns to global configuration mode.

Step 12

ipv6 dhcp guard policy policy-name

Example:

Device(config)# ipv6 dhcp guard policy server_side

Enters DHCP guard configuration mode and allows you to modify the configuration of the specified DHCP guard policy.

Step 13

device-role server

Example:

Device(config-dhcp-guard)# device-role server

Sets the role of the device that is attached to the server.

Step 14

exit

Example:

Device(config-destguard)# exit

Exits DHCP guard configuration mode and returns to global configuration mode.

Step 15

vlan configuration vlan-list-id

Example:

Device(config)# vlan configuration 100

Enters VLAN configuration mode and allows you to modify the configuration of the specified VLAN.

Step 16

ipv6 snooping attach-policy policy-name

Example:

Device(config-vlan-config)# ipv6 snooping attach-policy xyz

Attaches the IPv6 snooping policy to a VLAN.

Step 17

ipv6 destination-guard attach-policy policy-name

Example:

Device(config-vlan-config)# ipv6 destination-guard attach-policy xyz

Attaches the destination guard policy to the specified VLAN.
Note:
For information about how to configure an IPv6 destination guard policy, see the “IPv6 Destination Guard” module.

Step 18

end

Example:

Device(config-vlan-config)# end

Exits VLAN configuration mode and returns to privileged EXEC mode.

Configuring Address Gleaning and Associating Recovery Protocols with Prefix Lists

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 snooping policy snooping-policy-id

4.    protocol {dhcp | ndp} [prefix-list prefix-list-name]

5.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 snooping policy snooping-policy-id

Example:

Device(config)# ipv6 snooping policy 200

Enters IPv6 snooping configuration mode and allows you to modify the configuration of the snooping policy specified.

Step 4

protocol {dhcp | ndp} [prefix-list prefix-list-name]

Example:

Device(config-ipv6-snooping)# protocol dhcp prefix-list dhcp_prefix_list

Specifies that address should be gleaned with dynamic Host Configuration Protocol (DHCP) and associates a recovery protocol (DHCP) with the prefix list.

Step 5

end

Example:

Device(config-ipv6-snooping)# end

Exits IPv6 snooping configuration mode and returns to privileged EXEC mode.

Configuring IPv6 Device Tracking

Perform this task to provide fine tuning for the life cycle of an entry in the binding table for the IPv6 Device Tracking feature. For IPv6 device tracking to work, the binding table needs to be populated.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 neighbor tracking [retry-interval value]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 neighbor tracking [retry-interval value]

Example:

Device(config)# ipv6 neighbor tracking

Tracks entries in the binding table.

Configuring IPv6 Prefix Glean

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 snooping policy snooping-policy

4.    prefix-glean [only]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 snooping policy snooping-policy

Example:

Device(config)# ipv6 snooping policy policy1

Configures an IPv6 snooping policy and enters IPv6 snooping policy configuration mode.

Step 4

prefix-glean [only]

Example:

Device(config-ipv6-snooping)# prefix-glean

Enables the device to glean prefixes from IPv6 RAs or DHCPv6 traffic.

Example: Configuring IPv6 ND Inspection

Device(config)# ipv6 snooping policy policy1
Device(config-ipv6-snooping)# ipv6 snooping attach-policy policy1
Device(config-ipv6-snooping)# exit
.
.
.
Device# show ipv6 snooping policies policy1
Policy policy1 configuration:
trusted-port
device-role node
Policy applied on the following interfaces:
Et0/0                vlan all
Et1/0       vlan all
Policy applied on the following vlans:
vlan 1-100,200,300-400

Example: Configuring IPv6 ND Inspection and RA Guard

This example provides information about an interface on which both the Neighbor Discovery Inspection and RA Guard features are configured:

Device# show ipv6 snooping capture-policy interface ethernet 0/0

Hardware policy registered on Ethernet 0/0
Protocol     Protocol value   Message   Value     Action    Feature
ICMP         58               RS        85        punt      RA Guard
punt      ND Inspection
ICMP         58               RA        86        drop      RA guard
punt      ND Inspection
ICMP         58               NS        87        punt      ND Inspection
ICM          58               NA        88        punt      ND Inspection
ICMP         58               REDIR     89        drop      RA Guard
punt      ND Inspection

Example: Configuring IPv6 Binding Table Content

ipv6 neighbor binding vlan 100 ethernet 0/0 reachable-entries 100
ipv6 neighbor binding max-entries 100
ipv6 neighbor binding logging
exit

Example: Configuring IPv6 First-Hop Security Binding Table Recovery

ipv6 dhcp-client leasequery server 2001:db8::1 vlan 100
ipv6 neighbor binding vlan 100 2001:db8::1 interface ethernet3/0

ipv6 prefix-list abc permit 2001:DB8::/64 ge 128
ipv6 snooping policy xyz
destination-glean recovery dhcp
protocol dhcp prefix-list abc
ipv6 destination-guard policy xyz
exit

ipv6 dhcp guard policy server_side
device-role server

vlan configuration 100
ipv6 snooping attach-policy xyz
ipv6 destination-guard attach-policy xyz

interface ethernet3/0
switchport
switchport access vlan 100
switchport mode access
duplex auto
ipv6 dhcp guard attach-policy server_side

interface vlan100
no ip address
ipv6 address 2001:DB8::100/64

Example: Configuring Address Gleaning and Associating Recovery Protocols with Prefix Lists

The following example shows that NDP will be used for the recovery for all addresses and that DHCP will be used to recover addresses that match the prefix list called dhcp_prefix_list:

Device(config-ipv6-snooping)# protocol ndp
Device(config-ipv6-snooping)# protocol dhcp prefix-list dhcp_prefix_list

Example: Verifying IPv6 Device Tracking

Device# show ipv6 neighbor

IPv6 address               Link-Layer addr Interface vlan prlvl age   state      Time left
ND  FE80::A8BB:CCFF:FE01:F500  AABB.CC01.F500  Et0/0     100  0002    0   REACHABLE  8850
L   FE80::21D:71FF:FE99:4900   001D.7199.4900  Vl100     100  0080 7203   DOWN       N/A
ND  2001:600::1                AABB.CC01.F500  Et0/0     100  0003    0   REACHABLE  3181
ND  2001:300::1                AABB.CC01.F500  Et0/0     100  0007    0   REACHABLE  9559
L   2001:400::1                001D.7199.4900  Vl100     100  0080 7188   DOWN       N/A

Additional References for IPv6 Source Guard and Prefix Guard

Related Documents

Related Topic

Document Title

IPv6 addressing and connectivity

IPv6 Configuration Guide

IPv4 addressing

IP Addressing: IPv4 Addressing Configuration Guide

Cisco IOS commands

Cisco IOS Master Command List, All Releases

IPv6 commands

Cisco IOS IPv6 Command Reference

Cisco IOS IPv6 features

Cisco IOS IPv6 Feature Mapping

Standards and RFCs

Standard/RFC

Title

RFCs for IPv6

IPv6 RFCs

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for IPv6 Snooping

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for IPv6 Snooping

Feature Name

Releases

Feature Information

IPv6 Snooping

12.2(50)SY

15.0(1)SY

15.0(2)SE

15.1(2)SG

15.3(1)S

Cisco IOS XE Release 3.2SE

Cisco IOS XE Release 3.8S

Cisco IOS XE Release 3.9S

Cisco IOS Release 15.2(1)E

IPv6 snooping bundles several Layer 2 IPv6 first-hop security features, including IPv6 ND inspection, IPv6 device tracking, IPv6 address glean, and IPv6 first-hop security binding table recovery, to provide security and scalability. IPv6 snooping operates at Layer 2, or between Layer 2 and Layer 3, to provide IPv6 functions with security and scalability.

In Cisco IOS XE Release 3.9S, support was added for the Cisco CSR 1000V and the Cisco ASR 1000 Series Routers.

The following commands were introduced or modified: data-glean, debug ipv6 snooping, destination-glean, device-role, drop-unsecure, ipv6 nd inspection, ipv6 nd inspection policy, ipv6 neighbor binding logging, ipv6 neighbor binding max-entries, ipv6 neighbor binding vlan, ipv6 neighbor tracking, ipv6 snooping attach-policy, ipv6 snooping policy, prefix-glean, protocol (IPv6), sec-level minimum, show ipv6 neighbor binding, show ipv6 snooping capture-policy, show ipv6 snooping counters, show ipv6 snooping features, show ipv6 snooping policies, tracking, trusted-port.

Chapter 4. IPv6 Router Advertisement Throttler

The IPv6 Router Advertisement Throttler limits the amount of multicast Router Advertisements (RAs) circulating on the wireless network. The IPv6 RA throttler tracks router solicitations (RSs) and converts multicast RAs into multiple unicast RAs to forward to RS originators.

- Finding Feature Information

- Additional References

- Feature Information for IPv6 Router Advertisement Throttler

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

IPv6 RA Throttler Overview

The IPv6 Router Advertisement Throttler limits the amount of multicast Router Advertisements (RAs) circulating on the wireless network. The IPv6 RA throttler tracks router solicitations (RSs) and converts multicast RAs into multiple unicast RAs to forward to RS originators.

- Scalability Feature: IPv6 RA Throttler

- IPv6 RA Throttler Parameter Inheritance

- IPv6 RA Throttler Command Precedence Rules

Scalability Feature: IPv6 RA Throttler

Data center networks with large numbers of devices face a number of scale challenges, such as effective and efficient address resolution. For example, in wireless Layer 2 domains, bandwidth may be constrained, and the amount of control traffic generated by protocols such as IPv6 Neighbor Discovery (ND) or Multicast Listener Discovery (MLD) can quickly become prohibitive.

By snooping control traffic and maintaining a binding table that stores all active devices and their addresses on the link, the amount of control traffic flooded on the Layer 2 domain can be greatly reduced. Throttling occurs when the same message is sent multiple times from several devices that do not interact with each other, but they all interact with one or more common devices (e.g., the local device). The Layer 2 device can eliminate some of these messages without any adverse consequences for the protocol itself.

IPv6 RA Throttler Parameter Inheritance

The IPv6 RA throttler allows an inheritance process by which a parameter that is not defined at a certain hierarchical level is inherited from the level above it. A parameter is defined at a given level if a policy is attached at that level and the parameter in that policy is set to a value other than inherit.

Level inheritance is as follows:

- PORT inherits from VLAN.

- VLAN inherits from BOX.

The levels are defined as follows:

- DEFAULT. A policy always exists implicitly at this level. The default policy fields are set as follows:

Field

Parameter

throttle-period

600 seconds, or 10 minutes.

max-through

10 RAs per VLAN per 10 minutes.

allow

at-least 1 at-most 1

- 1 RA per device per 10 minutes.

interval-option

passthrough

- RAs are not throttled with the interval option.

medium-type

wire (port only)

- The port is wireless.

- VLAN: At the VLAN level, only one policy may be attached per VLAN.

- PORT: At the PORT level, a policy can be attached to the port. Only one such policy is allowed per port per VLAN.

Note

Policies must be attached at the VLAN or BOX level as well as at the PORT level for IPv6 RA throttler to operate at the PORT level.

IPv6 RA Throttler Command Precedence Rules

The allow at-least and allow at-most values applied at the VLAN level are the default for all devices in the VLAN. The values can be overridden on a per-port basis by applying another policy on the a specified port.

When you apply a policy on a port, any value that is not configured in that policy is inherited from the VLAN configuration. If the value is not configured in the VLAN policy, then the value is set to its default.

The max-through and medium-type commands are ignored by a VLAN or VLANs.

If your deployment has the same setting for the allow at-least and allow at-most values for all devices on all ports, then you need only to apply the policy on the relevant VLAN or VLANs. If some of wired ports in the deployment are connection wireless access points, then a policy with only the medium type configured needs to be applied on those specific ports.

Rules that are configured at the command-line interface (CLI) are applied in the following order:

1. Maximum pending hosts: If more than 35 hosts are pending, the RA throttler stops "remembering" them one by one and multicasts the next RA to all devices, including wireless devices.

2. RA interval option: If the RA has an interval option, then the interval-option command setting applies first. If the interval-option throttle command setting is configured, then this step is ignored. The default is to pass through all RAs with an interval option; that is, not to multicast the next RA to all devices, including wireless devices.

3. Per-device at-least setting: If the device that issued the RA has not yet sent the number of RAs configured by the allow at-least command, then the RA is multicast to all hosts, including hosts on wireless devices.

4. Per-device at-most setting: If the device that issued the RA has sent the number of RAs configured by the allow at-most command, then the RA is throttled. That is, the RA is multicast to all wired hosts and to wireless hosts with pending router solicitations (RSs) or reassociations.

5. Per VLAN: If the per-VLAN limit per the max-through command setting has been reached, then the message is throttled; otherwise, it is passed to all devices, including wireless devices.

Configuring the IPv6 RA Throttler Policy

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 nd ra-throttle policy policy-name

4.    allow {at-least {al-value | no-limit }} | {at-most {am-value | no-limit}} | {inherited}

5.    interval-option {ignore | inherit | pass-through | throttle}

6.    max-through {mt-value | inherit | no-limit}

7.    medium-type {access-point | wired}

8.    throttle-period {seconds | inherit}

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 nd ra-throttle policy policy-name

Example:

Device(config)# ipv6 nd ra-throttle policy policy1

Defines the RA throttler policy name and enters IPv6 RA throttle policy configuration mode.

Step 4

allow {at-least {al-value | no-limit }} | {at-most {am-value | no-limit}} | {inherited}

Example:

Device(config-nd-ra-throttle)# allow at-least 2 at-most 2

Limits the number of multicast RAs per device per throttle period in an RA throttler policy.

Step 5

interval-option {ignore | inherit | pass-through | throttle}

Example:

Device(config-nd-ra-throttle)# interval-option inherit

Adjusts the IPv6 RA interval in an RA throttler policy.

Step 6

max-through {mt-value | inherit | no-limit}

Example:

Device(config-nd-ra-throttle)# max-through 25

Limits multicast RAs per VLAN per throttle period.

Step 7

medium-type {access-point | wired}

Example:

Device(config-nd-ra-throttle)# medium-type wired

Indicates whether a device is wired or wireless.

Step 8

throttle-period {seconds | inherit}

Example:

Device(config-nd-ra-throttle)# throttle-period 300

Configures the throttle period in an IPv6 RA throttler policy.

Attaching the IPv6 RA Throttler Policy to a VLAN or VLANs

Before You Begin
You must create an IPv6 RA throttler policy before attaching it to a VLAN or VLANs. See the previous step to create an IPv6 RA throttler policy.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    vlan configuration

4.    ipv6 nd ra-throttle attach-policy

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

vlan configuration

Example:

Device(config)# vlan configuration vlan1

Configures a VLAN or a collection of VLANs and enters VLAN configuration mode.

Step 4

ipv6 nd ra-throttle attach-policy

Example:

Device(config-vlan-config)# ipv6 nd ra-throttle attach-policy policy1

Attaches an IPv6 RA throttler policy to a VLAN or a collection of VLANs.

Attaching the IPv6 RA Throttler Policy to a Port

Before You Begin

- You must create an IPv6 RA throttler policy before attaching it to a port. See the previous step to create an IPv6 RA throttler policy.

- Policies must be attached at the VLAN or BOX level as well as at the PORT level for the IPv6 RA throttler to operate at the PORT level.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    ipv6 nd ra-throttle attach-policy

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:

Device(config)# interface ethernet0/0

Specifies an interface type and number, and places the device in interface configuration mode.

Step 4

ipv6 nd ra-throttle attach-policy

Example:

Device(config-if)#

Attaches an IPv6 RA throttler policy to a Layer 2 interface.

Example: IPv6 RA Throttler Policy Configuration

Device# show ipv6 nd ra-throttle policy policy2

Policy policy2 configuration:
The throttle period will be coalesced and default to 600 seconds
Applied to a port, this policy indicates a wired interface
The maximum number of unthrottled RAs is configured on the vlan and defaults to 10
The min and max numbers of unthrottled RAs per router will be coalesced and default to 1
The behaviour upon RAs with an RFC 3775 interval option will be coalesced and default to passthrough

Policy applied on the following interfaces:
Et0/0                vlan all
Policy applied on the following vlans:
10,12-17

Example: IPv6 RA Throttler VLAN Configuration

Device# show ipv6 nd ra-throttler vlan vlan1

general information for vlan vlan1
===================================

RAs            last period     this period     overall
passed_through 1               1               2
throttled      4               2               6

no pending host

current Policy is tutu coalesced as:

throttle-period 90 seconds remaining 48
max-through 0
allow at-least 1 at-most 1
interval-option passthrough

Additional References

Related Documents

Related Topic

Document Title

IPv6 addressing and connectivity

IPv6 Configuration Guide

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

IPv6 commands

Cisco IOS IPv6 Command Reference

Cisco IOS IPv6 features

Cisco IOS IPv6 Feature Mapping

Standards and RFCs

Standard/RFC

Title

RFCs for IPv6

IPv6 RFCs

MIBs

MIB

MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for IPv6 Router Advertisement Throttler

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for

Feature Name

Releases

Feature Information

IPv6 Router Advertisement Throttler

Cisco IOS XE Release 3.2SE

15.2(1)E

15.2(1)SY

The IPv6 Router Advertisement Throttler feature limits the amount of multicast RAs circulating on the wireless network. The IPv6 RA throttler tracks RSs and converts multicast RAs into multiple unicast RAs to forward to RS originators.

The following commands were introduced or modified: allow, interval-option, ipv6 nd ra-throttle attach-policy, ipv6 nd ra-throttle policy, max-through, medium-type, show ipv6 nd ra-throttler interface, show ipv6 nd ra-throttler policy, show ipv6 nd ra-throttler vlan, throttle-period, vlan configuration.

Chapter 5. IPv6 Neighbor Discovery Multicast Suppress

IPv6 Neighbor Discovery (ND) Multicast Suppress suppresses the ND multicast Neighbor Solicit (NS) messages, by either dropping it (and responding to solicitations on behalf of the targets) or converting it into unicast traffic. The conversion of multicast traffic into unicast traffic is performed by replacing a Layer-2 Multicast Destination MAC with a Layer- 2 Unicast Destination MAC. This requires the knowledge of addresses on the link and their binding to the Layer-2. The multicast messages suppressed are Neighbor Solicitation (NS) messages.

- Finding Feature Information

- Restrictions for IPv6 DAD Proxy

- Additional References for IPv6 Neighbor Discovery Multicast Suppress

- Feature Information for IPv6 Neighbor Discovery Multicast Suppress

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Restrictions for IPv6 DAD Proxy

- The IPv6 Duplicate Address Detection (DAD) Proxy feature is not supported on Etherchannel ports.

Overview of IPv6 Neighbor Discovery Multicast Suppress

The IPv6 Neighbor Discovery (ND) multicast suppress feature stops the ND multicast Neighbor Solicit (NS) messages by dropping them (and responding to solicitations on behalf of the targets) or by converting them into unicast traffic. This feature reduces the amount of control traffic necessary for proper link operations.

When an address is inserted into the binding table, an address resolution request sent to a multicast address is intercepted, and the device either responds on behalf of the address owner or converts the request into a unicast message and forwards it to its destination.

The following figure provides an overview of this feature:

Overview of IPv6 DAD Proxy

The IPv6 Duplicate Address Detection (DAD) feature ensures that all the IP addresses assigned on a particular segment are unique. The process operates when IPv6 hosts directly communicate with one another where hosts cannot communicate directly, and a proxy is required.

After a host verifies that its address is unique, it enables the DAD procedure. However, when two hosts cannot communicate with each other, this procedure cannot detect a duplicate address. If the DAD procedure cannot run, both the hosts assigns the same link-local address, which causes both hosts to fail when they try to reach the Dynamic Host Configuration Protocol version 6 (DHCPv6 )server. The IPv6 DAD Proxy feature responds on behalf of the address owner when an address is in use.

The following figure provides an overview of the IPv6 DAD Proxy feature:

IPv6 DAD Proxy

Configuring IPv6 Neighbor Discovery Multicast Suppress on an Interface

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 nd suppress policy policy-name

4.    [no] mode mc-proxy

5.    [no] mode full-proxy

6.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 nd suppress policy policy-name

Example:

Device (config)# ipv6 nd suppress policy policy1
Device (config-nd-suppress)#

Specifies a name for the Neighbor Discovery (ND) suppress policy to be configured.

Step 4

[no] mode mc-proxy

Example:

Device (config-nd-suppress)# mode mc-proxy

Specifies if the ND suppress must proxy all multicast Neighbor Solicitation (NS) messages.

Step 5

[no] mode full-proxy

Example:

Device (config-nd-suppress)# mode full-proxy

Specifies if the ND suppress must proxy both unicast and multicast NS messages.

Step 6

end

Example:

Device (config-nd-suppress)# end

Exits the ND suppress mode and returns to privileged EXEC mode.

Configuring IPv6 DAD Proxy

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    [no] ipv6 nd dad-proxy

5.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:

Device(config)# interface GigabitEthernet 0/0/1

Specifies an interface type and number, and enters interface configuration mode.

Step 4

[no] ipv6 nd dad-proxy

Example:

Device(config-if)# ipv6 nd dad-proxy

Specifies if the ND suppress must operate in DAD-proxy mode.

In this mode, the DAD messages are not forwarded. They respond to an existing entry or are added to the binding table.

Step 5

end

Example:

Device(config-if)# end

Exits router interface configuration mode and returns to privileged EXEC mode.

Example: Configuring IPv6 Neighbor Discovery Suppress on an Interface

Device> enable
Device(config)# interface Ethernet 0/0
Device(config-if)# ipv6 nd suppress attach-policy policy1

Example: Configuring IPv6 DAD Proxy

Device> enable
Device# configure terminal
Device(config)# interface Ethernet 0/0
Device(config-if)# ipv6 nd dad-proxy
Device(config-if)# end

Additional References for IPv6 Neighbor Discovery Multicast Suppress

Related Documents

Related Topic

Document Title

IPv6 addressing and connectivity

IPv6 Configuration Guide

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

IPv6 commands

Cisco IOS IPv6 Command Reference

Cisco IOS IPv6 features

Cisco IOS IPv6 Feature Mapping

MIBs

MIB

MIBs Link

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for IPv6 Neighbor Discovery Multicast Suppress

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for IPv6 Neighbor Discovery Multicast Suppress

Feature Name

Releases

Feature Information

IPv6 Neighbor Discovery Multicast Suppress with DAD Proxy

15.1(2)SG

Cisco IOS XE Release 3.8S

Cisco IOS XE Release 3SE

Cisco IOS XE Release 3.9S

IPv6 Duplicate Address Detection (DAD) Proxy feature responds to the DAD queries on behalf of a node that owns the queried address. It is useful in environments where nodes cannot communicate directly on the link.

The following commands were introduced or modified: ipv6 nd dad-proxy, mode dad-proxy, mode md-proxy.

Chapter 6. IPv6 Destination Guard

The IPv6 Destination Guard feature works with IPv6 neighbor discovery to ensure that the device performs address resolution only for those addresses that are known to be active on the link. It relies on the address glean functionality to populate all destinations active on the link into the binding table and then blocks resolutions before they happen when the destination is not found in the binding table.

- Finding Feature Information

- Prerequisites for IPv6 Destination Guard

- Additional References

- Feature Information for IPv6 Destination Guard

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for IPv6 Destination Guard

- You should be familiar with the IPv6 Neighbor Discovery feature. For information about IPv6 neighbor discovery, see the “Implementing IPv6 Addressing and Basic Connectivity” module.

- You should be familiar with the IPv6 First-Hop Security Binding Table feature. For information, see the “IPv6 First-Hop Security Binding Table” module.

IPv6 Destination Guard Overview

The IPv6 Destination Guard feature works with IPv6 neighbor discovery to ensure that the device performs address resolution only for those addresses that are known to be active on the link. It relies on the address glean functionality to populate all destinations active on the link into the binding table and then blocks resolutions before they happen when the destination is not found in the binding table.

Prior to filtering incoming routed traffic, the device gleans addresses on the link, by snooping Neighbor Discovery Protocol (NDP) and DHCP messages. When a packet reaches the device and there is not yet an adjacency for the destination or for the next hop, the NDP consults the device binding table to verify that the destination on link or the next-hop have been previously gleaned. If the destination is not found in the binding table, the packet is dropped. Otherwise, neighbor discovery resolution is performed.

Configuring IPv6 Destination Guard

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 destination-guard policy policy-name

4.    enforcement {always | stressed}

5.    exit

6.    interface type number

7.    ipv6 destination-guard attach-policy [policy-name]

8.    exit

9.    show ipv6 destination-guard policy [policy-name]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 destination-guard policy policy-name

Example:

Device(config)# ipv6 destination-guard policy pol1

Defines the destination guard policy name and enters destination-guard configuration mode.

Step 4

enforcement {always | stressed}

Example:

Device(config-destguard)# enforcement always

Sets the enforcement level for the target address.

Step 5

exit

Example:

Device(config-destguard)# exit

Exits destination-guard configuration mode and returns to global configuration mode.

Step 6

interface type number

Example:

Device(config)# interface GigabitEthernet 0/0/1

Enters interface configuration mode.

Step 7

ipv6 destination-guard attach-policy [policy-name]

Example:

Device(config-if)# ipv6 destination-guard attach-policy pol1

Attaches a destination guard policy to an interface.

Step 8

exit

Example:

Device(config-if)# exit

Exits interface configuration mode and returns to privileged EXEC configuration mode.

Step 9

show ipv6 destination-guard policy [policy-name]

Example:

Device# show ipv6 destination-guard policy pol1

(Optional) Displays the policy configuration and all interfaces where the policy is applied.

Example: Configuring an IPv6 Destination Guard Policy

The following example shows how to configure a destination guard policy:

Router> enable
Router# configure terminal
Router(config)# interface GigabitEthernet 0/0/1
Router(config-if)# ipv6 destination-guard attach-policy destination

Router# show ipv6 destination-guard policy destination
Destination guard policy Destination:
enforcement always
Target: Gi0/0/1

Additional References

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

IPv6 addressing and connectivity

IPv6 Configuration Guide

IPv6 commands

Cisco IOS IPv6 Command Reference

Cisco IOS IPv6 features

Cisco IOS IPv6 Feature Mapping

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for IPv6 Destination Guard

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for IPv6 Destination Guard

Feature Name

Releases

Feature Information

IPv6 Destination Guard

15.2(4)S

15.2(1)E

15.1(2)SG

Cisco IOS XE Release 3.9S

IOS XE 3.6.0E, IOS 15.2(2)E

15.2(1)SY

The IPv6 Destination Guard feature blocks data traffic from an unknown source and filters IPv6 traffic based on the destination address.

In Cisco IOS XE Release 3.9S, support was added for the Cisco CSR 1000V.

In Cisco IOS XE Release 3.9S, support was added for the Cisco ASR 1000 Series Routers.

The following commands were introduced or modified: enforcement, ipv6 destination-guard attach-policy, ipv6 destination-guard policy, show ipv6 destination-guard policy.

Chapter 7. IPv6 RFCs

Standards and RFCs

RFCs

Title

RFC 1195

Use of OSI IS-IS for Routing in TCP/IP and Dual Environments

RFC 1267

A Border Gateway Protocol 3 (BGP-3)

RFC 1305

Network Time Protocol (Version 3) Specification, Implementation and Analysis

RFC 1583

OSPF version 2

RFC 1772

Application of the Border Gateway Protocol in the Internet

RFC 1886

DNS Extensions to Support IP version 6

RFC 1918

Address Allocation for Private Internets

RFC 1981

Path MTU Discovery for IP version 6

RFC 2080

RIPng for IPv6

RFC 2281

Cisco Hot Standby Router Protocol (HSRP)

RFC 2332

NBMA Next Hop Resolution Protocol (NHRP)

RFC 2373

IP Version 6 Addressing Architecture

RFC 2374

An Aggregatable Global Unicast Address Format

RFC 2375

IPv6 Multicast Address Assignments

RFC 2401

Security Architecture for the Internet Protocol

RFC 2402

IP Authentication Header

RFC 2404

The Use of Hash Message Authentication Code Federal Information Processing Standard 180-1 within Encapsulating Security Payload and Authentication Header

RFC 2406

IP Encapsulating Security Payload (ESP)

RFC 2407

The Internet Security Domain of Interpretation for ISAKMP

RFC 2408

Internet Security Association and Key Management Protocol

RFC 2409

Internet Key Exchange (IKE)

RFC 2427

Multiprotocol Interconnect over Frame Relay

RFC 2428

FTP Extensions for IPv6 and NATs

RFC 2460

Internet Protocol, Version 6 (IPv6) Specification

RFC 2461

Neighbor Discovery for IP Version 6 (IPv6)

RFC 2462

IPv6 Stateless Address Autoconfiguration

RFC 2463

Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification

RFC 2464

Transmission of IPv6 Packets over Ethernet

RFC 2467

Transmission of IPv6 Packets over FDDI

RFC 2472

IP Version 6 over PPP

RFC 2473

Generic Packet Tunneling in IPv6 Specification

RFC 2474

Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers

RFC 2475

An Architecture for Differentiated Services Framework

RFC 2492

IPv6 over ATM

RFC 2545

Use of BGP-4 Multiprotocol Extensions for IPv6 Inter-Domain Routing

RFC 2590

Transmission of IPv6 Packets over Frame Relay Specification

RFC 2597

Assured Forwarding PHB

RFC 2598

An Expedited Forwarding PHB

RFC 2640

Internet Protocol, Version 6 Specification

RFC 2684

Multiprotocol Encapsulation over ATM Adaptation Layer 5

RFC 2697

A Single Rate Three Color Marker

RFC 2698

A Two Rate Three Color Marker

RFC 2710

Multicast Listener Discovery (MLD) for IPv6

RFC 2711

IPv6 Router Alert Option

RFC 2732

Format for Literal IPv6 Addresses in URLs

RFC 2765

Stateless IP/ICMP Translation Algorithm (SIIT)

RFC 2766

Network Address Translation-Protocol Translation (NAT-PT)

RFC 2858

Multiprotocol Extensions for BGP-4

RFC 2893

Transition Mechanisms for IPv6 Hosts and Routers

RFC 3056

Connection of IPv6 Domains via IPv4 Clouds

RFC 3068

An Anycast Prefix for 6to4 Relay Routers

RFC 3095

RObust Header Compression (ROHC): Framework and Four Profiles: RTP, UDP, ESP, and Uncompressed

RFC 3107

Carrying Label Information in BGP-4

RFC 3137

OSPF Stub Router Advertisement

RFC 3147

Generic Routing Encapsulation over CLNS

RFC 3152

Delegation of IP6.ARPA

RFC 3162

RADIUS and IPv6

RFC 3315

Dynamic Host Configuration Protocol for IPv6 (DHCPv6)

RFC 3319

Dynamic Host Configuration Protocol (DHCPv6) Options for Session Initiated Protocol (SIP) Servers

RFC 3392

Capabilities Advertisement with BGP-4

RFC 3414

User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)

RFC 3484

Default Address Selection for Internet Protocol version 6 (IPv6)

RFC 3513

Internet Protocol Version 6 (IPv6) Addressing Architecture

RFC 3576

Change of Authorization

RFC 3587

IPv6 Global Unicast Address Format

RFC 3590

Source Address Selection for the Multicast Listener Discovery (MLD) Protocol

RFC 3596

DNS Extensions to Support IP Version 6

RFC 3633

DHCP IPv6 Prefix Delegation

RFC 3646

DNS Configuration options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6)

RFC 3697

IPv6 Flow Label Specification

RFC 3736

Stateless DHCP Service for IPv6

RFC 3756

IPv6 Neighbor Discovery (ND) Trust Models and Threats

RFC 3759

RObust Header Compression (ROHC): Terminology and Channel Mapping Examples

RFC 3775

Mobility Support in IPv6

RFC 3810

Multicast Listener Discovery Version 2 (MLDv2) for IPv6

RFC 3846

Mobile IPv4 Extension for Carrying Network Access Identifiers

RFC 3879

Deprecating Site Local Addresses

RFC 3898

Network Information Service (NIS) Configuration Options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6)

RFC 3954

Cisco Systems NetFlow Services Export Version 9

RFC 3956

Embedding the Rendezvous Point (RP) Address in an IPv6 Multicast Address

RFC 3963

Network Mobility (NEMO) Basic Support Protocol

RFC 3971

SEcure Neighbor Discovery (SEND)

RFC 3972

Cryptographically Generated Addresses (CGA)

RFC 4007

IPv6 Scoped Address Architecture

RFC 4075

Simple Network Time Protocol (SNTP) Configuration Option for DHCPv6

RFC 4087

IP Tunnel MIB

RFC 4091

The Alternative Network Address Types (ANAT) Semantics for the Session Description Protocol (SDP) Grouping Framework

RFC 4092

Usage of the Session Description Protocol (SDP) Alternative Network Address Types (ANAT) Semantics in the Session Initiation Protocol (SIP)

RFC 4109

Algorithms for Internet Key Exchange version 1 (IKEv1)

RFC 4191

Default Router Preferences and More-Specific Routes

RFC 4193

Unique Local IPv6 Unicast Addresses

RFC 4214

Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)

RFC 4242

Information Refresh Time Option for Dynamic Host Configuration Protocol for IPv6 (DHCPv6)

RFC 4282

The Network Access Identifier

RFC 4283

Mobile Node Identifier Option for Mobile IPv6

RFC 4285

Authentication Protocol for Mobile IPv6

RFC 4291

IP Version 6 Addressing Architecture

RFC 4292

IP Forwarding Table MIB

RFC 4293

Management Information Base for the Internet Protocol (IP)

RFC 4302

IP Authentication Header

RFC 4306

Internet Key Exchange (IKEv2) Protocol

RFC 4308

Cryptographic Suites for IPsec

RFC 4364

BGP MPLS/IP Virtual Private Networks (VPNs)

RFC 4382

MPLS/BGP Layer 3 Virtual Private Network (VPN) Management Information Base

RFC 4443

Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification

RFC 4552

Authentication/Confidentiality for OSPFv3

RFC 4594

Configuration Guidelines for DiffServ Service Classes

RFC 4601

Protocol Independent Multicast - Sparse Mode (PIM-SM): Protocol Specification

RFC 4610

Anycast-RP Using Protocol Independent Multicast (PIM)

RFC 4649

Dynamic Host Configuration Protocol for IPv6 (DHCPv6) Relay Agent Remote-ID Option

RFC 4659

BGP-MPLS IP Virtual Private Network (VPN) Extension for IPv6 VPN

RFC 4724

Graceful Restart Mechanism for BGP

RFC 4798

Connecting IPv6 Islands over IPv4 MPLS Using IPv6 Provider Edge Routers (6PE)

RFC 4818

RADIUS Delegated-IPv6-Prefix Attribute

RFC 4861

Neighbor Discovery for IP version 6 (IPv6)

RFC 4862

IPv6 Stateless Address Autoconfiguration

RFC 4884

Extended ICMP to Support Multi-Part Messages

RFC 4885

Network Mobility Support Terminology

RFC 4887

Network Mobility Home Network Models

RFC 5015

Bidirectional Protocol Independent Multicast (BIDIR-PIM)

RFC 5059

Bootstrap Router (BSR) Mechanism for Protocol Independent Multicast (PIM)

RFC 5072

IPv6 over PPP

RFC 5095

Deprecation of Type 0 Routing Headers in IPv6

RFC 5120

M-ISIS: Multi Topology (MT) Routing in Intermediate System to Intermediate Systems (IS-ISs)

RFC 5130

A Policy Control Mechanism in IS-IS Using Administrative Tags

RFC 5187

OSPFv3 Graceful Restart

RFC 5213

Proxy Mobile IPv6

RFC 5308

Routing IPv6 with IS-IS

RFC 5340

OSPF for IPv6

RFC 5460

DHCPv6 Bulk Leasequery

RFC 5643

Management Information Base for OSPFv3

RFC 5838

Support of Address Families in OSPFv3

RFC 5844

IPv4 Support for Proxy Mobile IPv6

RFC 5845

Generic Routing Encapsulation (GRE) Key Option for Proxy Mobile IPv6

RFC 5846

Binding Revocation for IPv6 Mobility

RFC 5881

Bidirectional Forwarding Detection (BFD) for IPv4 and IPv6 (Single Hop)

RFC 5905

Network Time Protocol Version 4: Protocol and Algorithms Specification

RFC 5969

IPv6 Rapid Deployment on IPv4 Infrastructures (6RD) -- Protocol Specification

RFC 6105

IPv6 Router Advertisement Guard

RFC 6620

FCFS SAVI: First-Come, First-Served Source Address Validation Improvement for Locally Assigned IPv6 Addresses