ipv6 checkspoof (S-, K-Series)

Use this command to provide checkspoof protection for transit frames being routed through the system.

Syntax

ipv6 checkspoof {strict-mode | loose-mode}

no ipv6 checkspoof {strict-mode | loose-mode}

Parameters

strict-mode	Verifies that the source IPv6 address is reachable from the receive interface.
loose-mode	Verifies that the source IPv6 address is reachable from any interface.

Defaults

None.

Mode

Configuration command, Interface configuration.

Usage

Network configurations that utilize VRRP may have connectivity issues to the backup interfaces when using checkspoof strict-mode. Under this circumstance, traffic may be routed via what appears to be the non-best path to the backup interface, due to the inherent nonsymmetric nature of VRRP routing. Strict-mode checkspoof rejects frames that do not ingress the “best” interface. When utilizing VRRP, use the loose-mode version of checkspoof. This mode verifies that the source IP in the packet is at least in a “known” network.

Example

This example enables strict-mode IPv6 checkspoofing on VLAN 1:

System(rw)->
System(rw)->configure
System(rw-config)->interface vlan.0.1
System(rw-config-intf-vlan.0.1)->ipv6 checkspoof strictmode

Published May 2016prev | next

Email this topic

Print this page Print this page

Leave feedback Feedback