Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

IPv6 global policies provide storage and access policy database services. IPv6 Neighbor Discovery (ND) Inspection and IPv6 RA Guard are IPv6 global policies features. Every time an ND inspection or RA guard is configured globally, the policy attributes are stored in the software policy database. The policy is then applied to an interface, and the software policy database entry is updated to include this interface to which the policy is applied.

IPv6 ND inspection learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables. IPv6 ND inspection analyzes neighbor discovery messages in order to build a trusted binding table database, and IPv6 neighbor discovery messages that do not have valid bindings are dropped. A neighbor discovery message is considered trustworthy if its IPv6-to-MAC mapping is verifiable.

This feature mitigates some of the inherent vulnerabilities for the neighbor discovery mechanism, such as attacks on duplicate address detection (DAD), address resolution, device discovery, and the neighbor cache.

1.    enable

2.    configure terminal

3.    ipv6 nd inspection policy policy-name

4.    drop-unsecure

5.    sec-level minimum value

6.    device-role {host | monitor | router}

7.    tracking {enable [reachable-lifetime {value | infinite}] | disable [stale-lifetime {value | infinite}]}

8.    trusted-port

1.    enable

2.    configure terminal

3.    interface type number

4.    ipv6 nd inspection [attach-policy [policy policy-name] | vlan {add | except | none | remove | all} vlan [vlan1, vlan2, vlan3...]]

1.    enable

2.    show ipv6 snooping capture-policy [interface type number]

3.    show ipv6 snooping counter [interface type number]

4.    show ipv6 snooping features

5.    show ipv6 snooping policies [interface type number]

6.    debug ipv6 snooping [binding-table | classifier | errors | feature-manager | filter acl | ha | hw-api | interface interface | memory | ndp-inspection | policy | vlan vlanid | switcher | filter acl | interface interface | vlanid]

• CA--certification authority.
• CGA--cryptographically generated address.
• CPA--certificate path answer.
• CPR--certificate path response.
• CPS--certification path solicitation. The solicitation message used in the addressing process.
• CRL--certificate revocation list.
• CS--certification server.
• CSR--certificate signing request.
• DAD--duplicate address detection. A mechanism that ensures two IPv6 nodes on the same link are not using the same address.
• DER--distinguished encoding rules. An encoding scheme for data values.
• nonce--An unpredictable random or pseudorandom number generated by a node and used once. In SeND, nonces are used to ensure that a particular advertisement is linked to the solicitation that triggered it.
• non-SeND node--An IPv6 node that does not implement SeND but uses only the Neighbor Discovery Protocol without security.
• NUD--neighbor unreachability detection. A mechanism used for tracking neighbor reachability.
• PACL--port-based access list.
• PKI--public key infrastructure.
• RA--router advertisement.
• RD--Router discovery allows the hosts to discover what devices exist on the link and what subnet prefixes are available. Router discovery is a part of the Neighbor Discovery Protocol.
• Router Authorization Certificate--A public key certificate.
• SeND node--An IPv6 node that implements SeND.
• trust anchor--An entity that the host trusts to authorize devices to act as devices. Hosts are configured with a set of trust anchors to protect device discovery.