IPv6 DHCP Snooping and ND Inspection Configuration Example

This section shows examples of IPv6 DHCP snooping and ND inspection configuration.

Enable DHCPv6 Guard, ND inspection, and First Hop Security.
ipv6 fhs dhcp-guard enable
ipv6 fhs nd-inspection enable
ipv6 fhs enable

Create VLAN 1000 and add port members.
vlan create 1000 type port-mstprstp 0
vlan members add 1000 1/1-1/10

Enable DHCPv6 snooping and ND inspection on VLAN 1000.
interface vlan 1000
ipv6 fhs snooping dhcp enable
ipv6 fhs nd-inspection enable
exit

Add static SBT entry.
ipv6 fhs snooping static-binding ipv6-address 2001:DB8:0:0:0001:02ff:fe03:0405 vlan 1000 mac-address 00:01:02:03:04:05 port 1/5

Set the DHCPv6 Guard device-role on port 1/1 of the device on which DHCPv6 Guard is configured.
interface gigabitEthernet 1/1
ipv6 fhs dhcp-guard device-role server
exit

Enable ND inspection on ports 1/2 through 1/10.
interface gigabitEthernet 1/2-1/10
ipv6 fhs nd-inspection enable
exit

View the status.
show ipv6 fhs port-policy
show ipv6 fhs status
show ipv6 fhs status vlan 
show ipv6 fhs snooping binding