Implementing First Hop Security in IPv6

IPv6 RA guard provides support for allowing the network administrator to block or reject unwanted or rogue RA guard messages that arrive at the network switch platform. RAs are used by routers to announce themselves on the link. The RA Guard feature analyzes these RAs and filters out bogus RAs sent by unauthorized routers. In host mode, all router advertisement and router redirect messages are disallowed on the port. The RA guard feature compares configuration information on the L2 device with the information found in the received RA frame. Once the L2 device has validated the content of the RA frame and router redirect frame against the configuration, it forwards the RA to its unicast or multicast destination. If the RA frame content is not validated, the RA is dropped.

IPv6 ND inspection learns and secures bindings for stateless autoconfiguration addresses in layer 2 neighbor tables. IPv6 ND inspection analyzes neighbor discovery messages in order to build a trusted binding table database, and IPv6 neighbor discovery messages that do not conform are dropped. SA neighbor discovery message is considered trustworthy if its IPv6-to-Media Access Control (MAC) mapping is verifiable.

This feature mitigates some of the inherent vulnerabilities for the neighbor discovery mechanism, such as attacks on duplicate address detection (DAD), address resolution, router discovery, and the neighbor cache.

There are three IPv6 neighbor discovery trust models, which are described as follows:

• All authenticated nodes trust each other to behave correctly at the IP layer and not to send any neighbor discovery or router discovery (RD) messages that contain false information. This model represents a situation where the nodes are under a single administration and form a closed or semiclosed group. A corporate intranet is an example of this model.
• A router trusted by the other nodes in the network to be a legitimate router that routes packets between the local network and any connected external networks. This router is trusted to behave correctly at the IP layer and not to send any neighbor discovery or RD messages that contain false information. This model represents a public network run by an operator. The clients pay the operator, have the operator's credentials, and trust the operator to provide the IP forwarding service. The clients do not trust each other to behave correctly; any other client node must be considered able to send falsified neighbor discovery and RD messages.
• A model where the nodes do not directly trust each other at the IP layer. This model is considered suitable where a trusted network operator is not available.

Nodes on the same link use ND to discover each other's presence and link-layer addresses, to find routers, and to maintain reachability information about the paths to active neighbors. ND is used by both hosts and routers. The original ND specifications used IPsec to protect ND messages. However, not many detailed instructions for using IPsec are available. The number of manually configured security associations needed for protecting ND can be very large, which makes that approach impractical for most purposes. These threats need to be considered and eliminated.

The SeND protocol counters ND threats. It defines a set of new ND options, and two new ND messages (Certification Path Solicitation [CPS] and Certification Path Answer [CPA]). It also defines a new autoconfiguration mechanism to be used in conjunction with the new ND options to establish address ownership.

SeND defines the mechanisms defined in the following sections for securing ND:

• Cryptographically Generated Addresses in SeND
• Authorization Delegation Discovery

• Host-to-Host Deployment Without a Trust Anchor
• Neighbor Solicitation Flow
• Host-Router Deployment Model
• Router Advertisement and Certificate Path Flows

The deployment model shown in the third figure above can be simplified in an environment where both hosts and routers trust a single CA such as the Cisco certification server (CS). The figure below illustrates this model.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 nd inspection policy policy-name

4.    drop-unsecure

5.    sec-level minimum value

6.    device-role {host | monitor | router}

7.    tracking {enable [reachable-lifetime {value | infinite}] | disable [stale-lifetime {value | infinite}]}

8.    trusted-port

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ipv6 nd inspection policy policy-name Example: Router(config)# ipv6 nd inspection policy policy1	Defines the ND inspection policy name and enters the router into ND inspection policy configuration mode.
Step 4	drop-unsecure Example: Router(config-nd-inspection)# drop-unsecure	Drops messages with no or invalid options or an invalid signature.
Step 5	sec-level minimum value Example: Router(config-nd-inspection)# sec-level minimum 2	Specifies the minimum security level parameter value when CGA options are used.
Step 6	device-role {host | monitor | router} Example: Router(config-nd-inspection)# device-role monitor	Specifies the role of the device attached to the port.
Step 7	tracking {enable [reachable-lifetime {value | infinite}] | disable [stale-lifetime {value | infinite}]} Example: Router(config-nd-inspection)# tracking disable stale-lifetime infinite	Overrides the default tracking policy on a port.
Step 8	trusted-port Example: Router(config-nd-inspection)# trusted-port	Configures a port to become a trusted port.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    ipv6 nd inspection [attach-policy [policy policy-name] | vlan {add | except | none | remove| all} vlan [vlan1, vlan2, vlan3...]]]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router(config)# interface fastethernet 0/0	Specifies an interface type and number, and places the router in interface configuration mode.
Step 4	ipv6 nd inspection [attach-policy [policy policy-name] | vlan {add | except | none | remove| all} vlan [vlan1, vlan2, vlan3...]]] Example: Router(config-if)# ipv6 nd inspection	Applies the ND inspection feature on the interface.

SUMMARY STEPS

1.    enable

2.    show ipv6 snooping capture-policy [interface type number]

3.    show ipv6 snooping counter [interface type number]

4.    show ipv6 snooping features

5.    show ipv6 snooping policies [interface type number]

6.    debug ipv6 snooping [binding-table | classifier | errors | feature-manager | filter acl | ha | hw-api | interface interface | memory | ndp-inspection | policy | vlan vlanid | switcher | filter acl | interface interface | vlanid

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	show ipv6 snooping capture-policy [interface type number] Example: Router# show ipv6 snooping capture-policy interface ethernet 0/0	Displays snooping ND message capture policies
Step 3	show ipv6 snooping counter [interface type number] Example: Router# show ipv6 snooping counters interface Fa4/12	Displays information about the packets counted by the interface counter.
Step 4	show ipv6 snooping features Example: Router# show ipv6 snooping features	Displays information about snooping features configured on the router.
Step 5	show ipv6 snooping policies [interface type number] Example: Router# show ipv6 snooping policies	Displays information about the configured policies and the interfaces to which they are attached.
Step 6	debug ipv6 snooping [binding-table | classifier | errors | feature-manager | filter acl | ha | hw-api | interface interface | memory | ndp-inspection | policy | vlan vlanid | switcher | filter acl | interface interface | vlanid Example: Router# debug ipv6 snooping	Enables debugging for snooping information in IPv6.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    ipv6 nd raguard attach-policy [policy-name [vlan {add| except | none | remove | all} vlan[vlan1, vlan2, vlan3...]]]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router(config)# interface Gigabit 0/0	Specifies an interface type and number, and places the router in interface configuration mode.
Step 4	ipv6 nd raguard attach-policy [policy-name [vlan {add| except | none | remove | all} vlan[vlan1, vlan2, vlan3...]]] Example: Router(config-if)# ipv6 nd raguard attach-policy	Applies the RA guard feature on a specified interface.

• Configuring IPv6 RA Guard in Cisco IOS Release 12.2(33)SXI4 and 12.2(54)SG

SUMMARY STEPS

1.    enable

2.    show ipv6 nd raguard policy [policy-name]

3.    debug ipv6 snooping raguard [filter | interface | vlanid]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	show ipv6 nd raguard policy [policy-name] Example: Router# show ipv6 nd raguard policy raguard1	Displays RAs guard policy on all interfaces configured with RA guard.
Step 3	debug ipv6 snooping raguard [filter | interface | vlanid] Example: Router# debug ipv6 snooping raguard	Enables debugging for snooping information in the IPv6 RA guard feature

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip http server

4.    crypto pki trustpoint name

5.    ip-extension [multicast | unicast] {inherit [ipv4 | ipv6] | prefix ipaddress | range min-ipaddress max-ipaddress}

6.    revocation-check {[crl] [none] [ocsp]}

7.    exit

8.    crypto pki server name

9.    grant auto

10.    cdp-url url-name

11.    no shutdown

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip http server Example: Router(config)# ip http server	Configures the HTTP server.
Step 4	crypto pki trustpoint name Example: Router(config)# crypto pki trustpoint CA	(Optional) Declares the trustpoint that your certificate server should use and enters ca-trustpoint configuration mode. If you plan to use X.509 IP extensions, use this command. To automatically generate a CS trustpoint, go to Step 8 .
Step 5	ip-extension [multicast | unicast] {inherit [ipv4 | ipv6] | prefix ipaddress | range min-ipaddress max-ipaddress} Example: Router(ca-trustpoint)# ip-extension prefix 2001:100::/32	(Optional) Specifies that the IP extensions are included in a certificate request either for enrollment or generation of a certificate authority (CA) for the Cisco IOS CA.
Step 6	revocation-check {[crl] [none] [ocsp]} Example: Router(ca-trustpoint)# revocation-check crl	(Optional) Sets one or more methods for revocation checking.
Step 7	exit Example: Router(ca-trustpoint)# exit	Returns to global configuration mode.
Step 8	crypto pki server name Example: Router(config)# crypto pki server CA	Configures the PKI server and places the router in server configuration mode.
Step 9	grant auto Example: Router(config-server)# grant auto	(Optional) Grants all certificate requests automatically.
Step 10	cdp-url url-name Example: Router(config-server)# cdp-url http://209.165.202.129/CA.crl	(Optional) Sets the URL name if the host is using a Certificate Revocation List (CRL).
Step 11	no shutdown Example: Router(config-server)# no shutdown	Enables the certificate server.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    crypto key generate rsa [general-keys | usage-keys | signature | encryption] [label key-label] [exportable][modulus modulus-size] [storage devicename :] [on devicename :]

4.    ipv6 cga modifier rsakeypair key-label sec-level {0 | 1}

5.    crypto pki trustpoint name

6.    enrollment [mode] [retry period minutes] [retry count number] url url [pem]

7.    revocation-check {[crl] [none] [ocsp]}

8.    exit

9.    crypto pki authenticate name

10.    ipv6 nd secured sec-level minimum value

11.    interface type number

12.    ipv6 cga rsakeypair key-label

13.    ipv6 address ipv6-address / prefix-length link-local cga

14.    ipv6 nd secured trustanchor trustanchor-name

15.    ipv6 nd secured timestamp {delta value | fuzz value}

16.    exit

17.    ipv6 nd secured full-secure

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Host> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Host# configure terminal	Enters global configuration mode.
Step 3	crypto key generate rsa [general-keys | usage-keys | signature | encryption] [label key-label] [exportable][modulus modulus-size] [storage devicename :] [on devicename :] Example: Host(config)# crypto key generate rsa label SEND modulus 1024	Configures the RSA key.
Step 4	ipv6 cga modifier rsakeypair key-label sec-level {0 | 1} Example: Host(config)# ipv6 cga modifier rsakeypair SEND sec-level 1	Enables the RSA key to be used by SeND (generates the modifier).
Step 5	crypto pki trustpoint name Example: Host(config)# crypto pki trustpoint SEND	Specifies the node trustpoint and enters ca-trustpoint configuration mode.
Step 6	enrollment [mode] [retry period minutes] [retry count number] url url [pem] Example: Host(ca-trustpoint)# enrollment url http://209.165.200.254	Specifies the enrollment parameters of a CA.
Step 7	revocation-check {[crl] [none] [ocsp]} Example: Host(ca-trustpoint)# revocation-check none	Sets one or more methods of revocation.
Step 8	exit Example: Host(ca-trustpoint)# exit	Returns to global configuration mode.
Step 9	crypto pki authenticate name Example: Host(config)# crypto pki authenticate SEND	Authenticates the certification authority (by getting the certificate of the CA).
Step 10	ipv6 nd secured sec-level minimum value Example: Host(config)# ipv6 nd secured sec-level minimum 1	(Optional) Configures CGA. You can provide additional parameters such as security level and key size. In the example, the security level accepted by peers is configured.
Step 11	interface type number Example: Host(config)# interface fastethernet 0/0	Specifies an interface type and number, and places the router in interface configuration mode.
Step 12	ipv6 cga rsakeypair key-label Example: Host(config-if)# ipv6 cga rsakeypair SEND	(Optional) Configures CGA on interfaces.
Step 13	ipv6 address ipv6-address / prefix-length link-local cga Example: Host(config-if)# ipv6 address FE80::260:3EFF:FE11:6770/23 link-local cga	Configures an IPv6 link-local address for the interface and enables IPv6 processing on the interface.
Step 14	ipv6 nd secured trustanchor trustanchor-name Example: Host(config-if)# ipv6 nd secured trustanchor SEND	(Optional) Configures trusted anchors to be preferred for certificate validation.
Step 15	ipv6 nd secured timestamp {delta value | fuzz value} Example: Host(config-if)# ipv6 nd secured timestamp delta 300	(Optional) Configures the timing parameters.
Step 16	exit Example: Host(config-if)# exit	Returns to global configuration mode.
Step 17	ipv6 nd secured full-secure Example: Host(config)# ipv6 nd secured full-secure	(Optional) Configures general SeND parameters. In the example, secure mode is configured on SeND.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    crypto key generate rsa [general-keys | usage-keys | signature | encryption] [label key-label] [exportable][modulus modulus-size] [storage devicename:] [on devicename:]

4.    ipv6 cga modifier rsakeypair key-label sec-level {0 | 1}

5.    crypto pki trustpoint name

6.    subject-name [attr tag][eq | ne | co | nc] string

7.    rsakeypair key-label

8.    revocation-check {[crl][none][ocsp]}

9.    exit

10.    crypto pki authenticate name

11.    crypto pki enroll name

12.    ipv6 nd secured sec-level minimum value

13.    interface type number

14.    ipv6 cga rsakeypair key-label

15.    ipv6 address ipv6-address / prefix-length link-local cga

16.    ipv6 nd secured trustanchor trustpoint-name

17.    ipv6 nd secured timestamp {delta value | fuzz value}

18.    exit

19.    ipv6 nd secured full-secure

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	crypto key generate rsa [general-keys | usage-keys | signature | encryption] [label key-label] [exportable][modulus modulus-size] [storage devicename:] [on devicename:] Example: Router(config)# crypto key generate rsa label SEND modulus 1024	Configures the RSA key.
Step 4	ipv6 cga modifier rsakeypair key-label sec-level {0 | 1} Example: Router(config)# ipv6 cga modifier rsakeypair SEND sec-level 1	Enables the RSA key to be used by SeND (generates the modifier).
Step 5	crypto pki trustpoint name Example: Router(config)# crypto pki trustpoint SEND	Configures PKI for a single or multiple-tier CA, specifies the router trustpoint, and places the router in ca-trustpoint configuration mode.
Step 6	subject-name [attr tag][eq | ne | co | nc] string Example: Router(ca-trustpoint)# subject-name C=FR, ST=PACA, L=Example, O=Cisco, OU=NSSTG, CN=router	Creates a rule entry.
Step 7	rsakeypair key-label Example: Router(ca-trustpoint)# rsakeypair SEND	Binds the RSA key pair for SeND.
Step 8	revocation-check {[crl][none][ocsp]} Example: Router(ca-trustpoint)# revocation-check none	Sets one or more methods of revocation.
Step 9	exit Example: host(ca-trustpoint)# exit	Returns to global configuration mode.
Step 10	crypto pki authenticate name Example: host(config)# crypto pki authenticate SEND	Authenticates the certification authority (by getting the certificate of the CA).
Step 11	crypto pki enroll name Example: Router(config)# crypto pki enroll SEND	Obtains the certificates for the router from the CA.
Step 12	ipv6 nd secured sec-level minimum value Example: Router(config)# ipv6 nd secured sec-level minimum 1	(Optional) Configures CGA and provides additional parameters such as security level and key size. In the example, the minimum security level that SeND accepts from its peers is configured.
Step 13	interface type number Example: Router(config)# interface fastethernet 0/0	Specifies an interface type and number, and places the router in interface configuration mode.
Step 14	ipv6 cga rsakeypair key-label Example: Router(config-if)# ipv6 cga rsakeypair SEND	(Optional) Configures CGA on interfaces. In the example, CGA is generated.
Step 15	ipv6 address ipv6-address / prefix-length link-local cga Example: Router(config-if)# ipv6 address fe80::link-local cga	Configures an IPv6 link-local address for the interface and enables IPv6 processing on the interface.
Step 16	ipv6 nd secured trustanchor trustpoint-name Example: Router(config-if)# ipv6 nd secured trustanchor SEND	(Optional) Configures trusted anchors to be preferred for certificate validation.
Step 17	ipv6 nd secured timestamp {delta value | fuzz value} Example: Router(config-if)# ipv6 nd secured timestamp delta 300	(Optional) Configures the timing parameters.
Step 18	exit Example: Router(config-if)# exit	Returns to global configuration mode.
Step 19	ipv6 nd secured full-secure Example: Router(config)# ipv6 nd secured full-secure	(Optional) Configures general SeND parameters, such as secure mode and authorization method. In the example, SeND security mode is enabled.

• Creating the RSA Key Pair and CGA Modifier for the Key Pair
• Configuring Certificate Enrollment for a PKI
• Configuring a Cryptographically Generated Address
• Configuring General CGA Parameters
• Configuring CGA Address Generation on an Interface

• Configuring the SeND Trustpoint
• Configuring SeND Trust Anchors on the Interface
• Configuring Secured and Nonsecured Neighbor Discovery Message Coexistence Mode
• Configuring SeND Parameters Globally
• Configuring the SeND Time Stamp

The first task in configuring IPv6 PACL is to create an IPv6 access list. This task is described in detail in Implementing Traffic Filters and Firewalls for IPv6 Security.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    access-group mode {prefer {port | vlan} | merge}

5.    ipv6 traffic-filter access-list-name {in | out

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router(config)# interface fastethernet 0/0	Specifies an interface type and number, and places the router in interface configuration mode.
Step 4	access-group mode {prefer {port | vlan} | merge} Example: Router(config-if)# access-group mode prefer port	Sets the mode for the specified layer 2 interface. The no form of this command sets the mode to the default value, which is merge. The prefer vlan keyword combination is not supported in IPv6.
Step 5	ipv6 traffic-filter access-list-name {in | out Example: Router(config-if)# ipv6 traffic-filter list1 in	Filters incoming IPv6 traffic on an interface. Note    The out keyword and therefore filtering of outgoing traffic is not supported in IPv6 PACL configuration.