Configure disable processing of IP packets for IPv6

To prevent Denial of Service (DoS) attack on the servers using large stream of packets containing IP options Routing Header (type 0) (for IPv6 packets), they must be dropped. This packet is processed by default. This section describes how to disable ip packet processing and prevent this type of attack.

By default, all IPv6 packets with Routing Header (type 0) are processed. This feature must be enabled explicitly to implement this mitigation.

To configure dropping of packets with IP options Routing Header (IPv6 packets), do the following.

  1. Navigate to the Global Configuration Mode.
    SLX # config terminal
    SLX (config)#                
  2. Execute one of the following commands.
    • For dropping IPv6 packets, execute

      SLX (config)# ipv6 option disable

Packets containing IP options Routing Header (type 0) (IPv6 packets) are dropped.