IPv6 Source Guard and Prefix Guard

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

IPv6 source guard is an interface feature between the populated binding table and data traffic filtering. This feature enables the device to deny traffic when it is originated from an address that is not stored in the binding table. IPv6 source guard does not inspect ND or DHCP packets; rather, it works in conjunction with IPv6 neighbor discovery (ND) inspection or IPv6 address glean, both of which detect existing addresses on the link and store them into the binding table. IPv6 source guard is an interface between the populated binding table and data traffic filtering, and the binding table must be populated with IPv6 prefixes for IPv6 source guard to work.

IPv6 source guard can deny traffic from unknown sources or unallocated addresses, such as traffic from sources not assigned by a DHCP server. When traffic is denied, the IPv6 address glean feature is notified so that it can try to recover the traffic by querying the DHCP server or by using IPv6 ND. The data-glean function prevents the device and end user from getting deadlocked, whereupon a valid address fails to be stored into the binding table, there is no recovery path, and the end user is unable to connect.

The following illustration provides an overview of how IPv6 source guard works with IPv6 address glean:

The IPv6 Prefix Guard feature works within the IPv6 source guard feature, enabling the device to deny traffic originated from nontopologically correct addresses. IPv6 prefix guard is often used when IPv6 prefixes are delegated to devices (e.g., home gateways) using DHCP prefix delegation. The feature discovers ranges of addresses assigned to the link and blocks any traffic sourced with an address outside this range.

To determine which prefixes should be allowed and which prefixes should be blocked, IPv6 prefix guard uses the following:

• Prefix glean in Router Advertisements (RAs)
• Prefix glean in DHCP prefix delegation
• Static configuration

Whenever a prefix is to be allowed, IPv6 prefix guard downloads it to the hardware table. Whenever a packet is switched, the hardware matches the source of the packet against this table and drops the packet if no match is found.

The following figure shows a service provider (SP) scenario in which prefixes are gleaned in DHCP-PD messages.

1.    enable

2.    configure terminal

3.   ipv6 source-guard policy snooping-policy

4.   permit link-local

5.   deny global-autoconfig

6.   trusted

7.   exit

8.   show ipv6 source-guard policy [snooping-policy]

Device> enable

Device# configure terminal

Device(config)# ipv6 source-guard policy

Device(config-source-guard)# permit link-local

Device(config-source-guard)# deny global-autoconfig

trusted

Device(config-if)# exit

1.    enable

2.    configure terminal

3.    interface type number

4.   ipv6 source-guard attach-policy [snooping-policy]

5.   exit

6.   show ipv6 source-guard policy [snooping-policy]

1.    enable

2.    configure terminal

3.   ipv6 source-guard policy snooping-policy

4.   validate address

5.   validate prefix

6.   exit

7.   show ipv6 source-guard policy [snooping-policy]