Version 34.1.1 introduces IPv6 First-Hop Security features that protect edge ports from IPv6 attacks and unauthorized network access.
Overview: IPv6 First-Hop Security implements multiple edge protection mechanisms that work together to prevent IPv6-based attacks and enforce network access policies:
RA Guard: Blocks rogue Router Advertisements on untrusted ports, preventing router impersonation and man-in-the-middle attacks.
DHCPv6 Snooping: Blocks DHCPv6 server messages on untrusted ports, preventing rogue DHCPv6 servers. It also builds a binding table of IPv6 address, MAC address, VLAN and port from DHCPv6 exchanges, similar to DHCPv4 snooping.
IPv6 Source Guard: Allows IPv6 traffic on a port only from source addresses in the binding table, learned through DHCPv6 snooping or configured as static bindings. Traffic from link-local source addresses is denied by default.
Neighbor Discovery Inspection (NDI): Validates Neighbor Solicitation and Neighbor Advertisement messages against the binding table, preventing neighbor spoofing and neighbor cache poisoning attacks.
Enable RA Guard:
enable ip-security {ipv6} ra-guard {vlan} vlan_name ports [port_list | all] [violation-action [drop-packet {[block-port | block-mac] [permanently | duration duration_in_seconds]}]]
Disable RA Guard:
disable ip-security {ipv6} ra-guard {vlan} vlan_name ports [port_list | all]
Configure or unconfigure trusted ports for routers that send IPv6 Router Advertisements:
[configure | unconfigure] trusted-ports {ipv6} [port_list | all] trust-for router
Enable DHCPv6 snooping:
enable ip-security ipv6 dhcp-snooping {vlan} vlan_name ports [port_list | all] violation-action [none | drop-packet {[block-port | block-mac] [permanently | duration duration_in_seconds]}]
Disable DHCPv6 snooping:
disable ip-security ipv6 dhcp-snooping {vlan} vlan_name ports [port_list | all]
Clear DHCPv6 snooping entries:
clear ip-security ipv6 dhcp-snooping entries {vlan} vlan_name {ipv6-address [ipv6_address] | ports [port_list]}
Add a DHCPv6 binding entry:
configure ip-security dhcp-bindings add ipv6 ipv6_address mac mac_address {vlan} vlan_name server-port server_port client-port client_port lease-time seconds
Delete a DHCPv6 binding entry:
configure ip-security dhcp-bindings delete ipv6 ipv6_address {vlan} vlan_name
Configure or unconfigure trusted ports for DHCPv6 servers:
[configure | unconfigure] trusted-ports ipv6 [port_list | all] trust-for dhcp-server
Enable or disable DHCPv6 binding restoration:
[enable | disable] ip-security dhcp-bindings restoration {ipv4-only | ipv6-only | both}
Enable IPv6 Source Guard:
enable ip-security ipv6 source-ip-lockdown ports [port_list | all] {link-local [permit | deny]}
Disable IPv6 Source Guard:
disable ip-security ipv6 source-ip-lockdown ports [port_list | all]
Clear IPv6 Source Guard entries:
clear ip-security ipv6 source-ip-lockdown entries ports [port_list | all]
Enable Neighbor Discovery Inspection:
enable ip-security {ipv6} nd-inspection source-mac destination-mac ip vlan vlan_name ports [port_list | all] violation-action drop-packet {block-port [permanently | duration duration_in_seconds]}
Disable Neighbor Discovery Inspection:
disable ip-security {ipv6} nd-inspection {vlan} vlan_name ports [port_list | all]
Clear Neighbor Discovery Inspection violations:
clear ip-security {ipv6} nd-inspection violations
Show RA Guard configuration:
show ip-security {ipv6} ra-guard {vlan} vlan_name
Show RA Guard violations:
show ip-security {ipv6} ra-guard violations {vlan} vlan_name
Show DHCPv6 snooping configuration for a VLAN:
show ip-security ipv6 dhcp-snooping {vlan} vlan_name
Show DHCPv6 snooping entries for a VLAN:
show ip-security ipv6 dhcp-snooping entries {vlan} vlan_name
Show DHCPv6 snooping entries for a list of VLANs:
show ip-security ipv6 dhcp-snooping entries vlan vlan_list
Show DHCPv6 snooping violations for a VLAN:
show ip-security ipv6 dhcp-snooping violations {vlan} vlan_name
Show DHCPv6 snooping violations for a list of VLANs:
show ip-security ipv6 dhcp-snooping violations vlan vlan_list
Show IPv6 Source Guard:
show ip-security ipv6 source-ip-lockdown
Show Neighbor Discovery Inspection configuration:
show ip-security {ipv6} nd-inspection {vlan} vlan_name
Show Neighbor Discovery Inspection for a list of VLANs:
show ip-security {ipv6} nd-inspection vlan vlan_list
Show Neighbor Discovery Inspection violation count:
show ip-security {ipv6} nd-inspection violations {vlan} vlan_name {ports [port_list | all]}
In a Layer 2 setup, if IPv4 source IP lockdown is enabled on a port and IPv6 source IP lockdown is not, DHCPv6 snooping does not learn bindings for the clients on that port. To avoid this, also enable IPv6 source IP lockdown on the same ports. Do not enable source IP lockdown on the port that faces the DHCPv6 server.
All platforms.