IPv6 DHCP Snooping and ND Inspection Configuration Example

Enable DHCPv6 Guard, ND inspection, and First Hop Security.

ipv6 fhs dhcp-guard enable
ipv6 fhs nd-inspection enable
ipv6 fhs enable

Create VLAN 1000 and add port members.

vlan create 1000 type port-mstprstp 0
vlan members add 1000 1/1-1/10

Enable DHCPv6 snooping and ND inspection on VLAN 1000.

interface vlan 1000
ipv6 fhs snooping dhcp enable
ipv6 fhs nd-inspection enable
exit

Add static SBT entry.

ipv6 fhs snooping static-binding ipv6-address 2001:DB8:0:0:0001:02ff:fe03:0405 vlan 1000 mac-address 00:01:02:03:04:05 port 1/5

Set the DHCPv6 Guard device-role on port 1/1 of the device on which DHCPv6 Guard is configured.

interface gigabitEthernet 1/1
ipv6 fhs dhcp-guard device-role server
exit

Enable ND inspection on ports 1/2 through 1/10.

interface gigabitEthernet 1/2-1/10
ipv6 fhs nd-inspection enable
exit

View the status.

show ipv6 fhs port-policy
show ipv6 fhs status
show ipv6 fhs status vlan 
show ipv6 fhs snooping binding