Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http:/​/​www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

First Hop Security in IPv6 (FHS IPv6) is a set of IPv6 security features, the policies of which can be attached to a physical interface, an EtherChannel interface, or a VLAN. An IPv6 software policy database service stores and accesses these policies. When a policy is configured or modified, the attributes of the policy are stored or updated in the software policy database, then applied as was specified. The following IPv6 policies are currently supported:

• IPv6 Snooping Policy—IPv6 Snooping Policy acts as a container policy that enables most of the features available with FHS in IPv6.

• IPv6 FHS Binding Table Content—A database table of IPv6 neighbors connected to the switch is created from information sources such as Neighbor Discovery (ND) protocol snooping. This database, or binding, table is used by various IPv6 guard features (such as IPv6 ND Inspection) to validate the link-layer address (LLA), the IPv4 or IPv6 address, and prefix binding of the neighbors to prevent spoofing and redirect attacks.
• IPv6 Neighbor Discovery Inspection—IPv6 ND inspection learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables. IPv6 ND inspection analyzes neighbor discovery messages in order to build a trusted binding table database and IPv6 neighbor discovery messages that do not conform are dropped. An ND message is considered trustworthy if its IPv6-to-Media Access Control (MAC) mapping is verifiable.

  This feature mitigates some of the inherent vulnerabilities of the ND mechanism, such as attacks on DAD, address resolution, router discovery, and the neighbor cache.

• IPv6 Router Advertisement Guard—The IPv6 Router Advertisement (RA) guard feature enables the network administrator to block or reject unwanted or rogue RA guard messages that arrive at the network switch platform. RAs are used by routers to announce themselves on the link. The RA Guard feature analyzes the RAs and filters out bogus RAs sent by unauthorized routers. In host mode, all router advertisement and router redirect messages are disallowed on the port. The RA guard feature compares configuration information on the Layer 2 device with the information found in the received RA frame. Once the Layer 2 device has validated the content of the RA frame and router redirect frame against the configuration, it forwards the RA to its unicast or multicast destination. If the RA frame content is not validated, the RA is dropped.

• IPv6 DHCP Guard—The IPv6 DHCP Guard feature blocks reply and advertisement messages that come from unauthorized DHCPv6 servers and relay agents. IPv6 DHCP guard can prevent forged messages from being entered in the binding table and block DHCPv6 server messages when they are received on ports that are not explicitly configured as facing a DHCPv6 server or DHCP relay. To use this feature, configure a policy and attach it to an interface or a VLAN. To debug DHCP guard packets, use the debug ipv6 snooping dhcp-guard privileged EXEC command.

• IPv6 Source Guard—Like IPv4 Source Guard, IPv6 Source Guard validates the source address or prefix to prevent source address spoofing.

  A source guard programs the hardware to allow or deny traffic based on source or destination addresses. It deals exclusively with data packet traffic.

  The IPv6 source guard feature provides the ability to use the IPv6 binding table to install PACLs to prevent a host from sending packets with an invalid IPv6 source address.

  To debug source-guard packets, use the debug ipv6 snooping source-guard privileged EXEC command.

  Note	The IPv6 PACL feature is supported only in the ingress direction; it is not supported in the egress direction.

  The following restrictions apply:

  • An FHS policy cannot be attached to an physical port when it is a member of an EtherChannel group.

  • When IPv6 source guard is enabled on a switch port, NDP or DHCP snooping must be enabled on the interface to which the switch port belongs. Otherwise, all data traffic from this port will be blocked.

  • An IPv6 source guard policy cannot be attached to a VLAN. It is supported only at the interface level.

  • You cannot use IPv6 Source Guard and Prefix Guard together. When you attach the policy to an interface, it should be "validate address" or "validate prefix" but not both.

  • PVLAN and Source/Prefix Guard cannot be applied together.

  For more information on IPv6 Source Guard, see the IPv6 Source Guard chapter of the Cisco IOS IPv6 Configuration Guide Library on Cisco.com.

  • IPv6 Prefix Guard—The IPv6 prefix guard feature works within the IPv6 source guard feature, to enable the device to deny traffic originated from non-topologically correct addresses. IPv6 prefix guard is often used when IPv6 prefixes are delegated to devices (for example, home gateways) using DHCP prefix delegation. The feature discovers ranges of addresses assigned to the link and blocks any traffic sourced with an address outside this range.

    For more information on IPv6 Prefix Guard, see the IPv6 Prefix Guard chapter of the Cisco IOS IPv6 Configuration Guide Library on Cisco.com.

  • IPv6 Destination Guard—The IPv6 destination guard feature works with IPv6 neighbor discovery to ensure that the device performs address resolution only for those addresses that are known to be active on the link. It relies on the address glean functionality to populate all destinations active on the link into the binding table and then blocks resolutions before they happen when the destination is not found in the binding table.

    Note	IPv6 Destination Guard is recommended only on Layer 3. It is not recommended on Layer2.

    For more information about IPv6 Destination Guard, see the IPv6 Destination Guard chapter of the Cisco IOS IPv6 Configuration Guide Library on Cisco.com.

  • IPv6 Neighbor Discovery Multicast Suppress—The IPv6 Neighbor Discovery multicast suppress feature is an IPv6 snooping feature that runs on a switch or a wireless controller and is used to reduce the amount of control traffic necessary for proper link operations.

  • DHCPv6 Relay—Lightweight DHCPv6 Relay Agent—The DHCPv6 Relay—Lightweight DHCPv6 Relay Agent feature allows relay agent information to be inserted by an access node that performs a link-layer bridging (non-routing) function. Lightweight DHCPv6 Relay Agent (LDRA) functionality can be implemented in existing access nodes, such as DSL access multiplexers (DSLAMs) and Ethernet switches, that do not support IPv6 control or routing functions. LDRA is used to insert relay-agent options in DHCP version 6 (DHCPv6) message exchanges primarily to identify client-facing interfaces. LDRA functionality can be enabled on an interface and on a VLAN.

    For more information about DHCPv6 Relay, See the DHCPv6 Relay—Lightweight DHCPv6 Relay Agent section of the IP Addressing: DHCP Configuration Guide, Cisco IOS Release 15.1SG.

1.    configure terminal


2.    ipv6 snooping policy policy-name


3.    {[default ] | [device-role {node | switch}] | [limit address-count value] | [no] | [protocol {dhcp | ndp} ] | [security-level {glean | guard | inspect} ] | [tracking {disable [stale-lifetime [seconds | infinite] | enable [reachable-lifetime [seconds | infinite] } ] | [trusted-port ] }


4.    end


5.    show ipv6 snooping policy policy-name

Switch# configure terminal

Switch(config)# ipv6 snooping policy example_policy

Switch(config-ipv6-snooping)# exit

Switch#show ipv6 snooping policy example_policy

Attach an IPv6 Snooping policy to interfaces or VLANs.

1.    configure terminal


2.    [no] ipv6 neighbor binding [vlan vlan-id {ipv6-address interface interface_type stack/module/port hw_address [reachable-lifetimevalue [seconds | default | infinite] | [tracking{ [default | disable] [ reachable-lifetimevalue [seconds | default | infinite] | [enable [reachable-lifetimevalue [seconds | default | infinite] | [retry-interval {seconds| default [reachable-lifetimevalue [seconds | default | infinite] } ]


3.    [no] ipv6 neighbor binding max-entries number [mac-limit number | port-limit number [mac-limit number] | vlan-limit number [ [mac-limit number] | [port-limit number [mac-limitnumber] ] ] ]


4.    ipv6 neighbor binding logging


5.    exit


6.    show ipv6 neighbor binding

Switch# configure terminal

Switch(config)#  ipv6 neighbor binding 

Switch(config)#  ipv6 neighbor binding max-entries 30000

Switch(config)# ipv6 neighbor binding logging  

Switch(config)# exit   

Switch#  show ipv6 neighbor binding  

1.    configure terminal


2.    [no]ipv6 nd inspection policy policy-name


3.    device-role {host | monitor | router | switch}


4.    drop-unsecure


5.    limit address-count value


6.    sec-level minimum value


7.    tracking {enable [reachable-lifetime {value | infinite}] | disable [stale-lifetime {value | infinite}]}


8.    trusted-port


9.    validate source-mac


10.    no {device-role | drop-unsecure | limit address-count | sec-level minimum | tracking | trusted-port | validate source-mac}


11.    default {device-role | drop-unsecure | limit address-count | sec-level minimum | tracking | trusted-port | validate source-mac}


12.    do show ipv6 nd inspection policy policy_name

Switch# configure terminal

Switch(config)# ipv6 nd inspection policy example_policy

Switch(config-nd-inspection)# device-role switch

Switch(config-nd-inspection)# drop-unsecure

Switch(config-nd-inspection)# limit address-count 1000

Switch(config-nd-inspection)# limit address-count 1000

Switch(config-nd-inspection)# tracking disable stale-lifetime infinite

Switch(config-nd-inspection)# trusted-port

Switch(config-nd-inspection)# validate source-mac

Switch(config-nd-inspection)# no validate source-mac

Switch(config-nd-inspection)# default limit address-count

Switch(config-nd-inspection)# do show ipv6 nd inspection policy example_policy

1.    enable


2.    configure terminal


3.    ipv6 nd suppress policy policy-name


4.    mode dad-proxy


5.    mode full-proxy


6.    mode mc-proxy

Switch> enable

1.    configure terminal


2.    [no]ipv6 nd raguard policy policy-name


3.    [no]device-role {host | monitor | router | switch}


4.    [no]hop-limit {maximum | minimum} value


5.    [no]managed-config-flag {off | on}


6.    [no]match {ipv6 access-list list | ra prefix-list list}


7.    [no]other-config-flag {on | off}


8.    [no]router-preference maximum {high | medium | low}


9.    [no]trusted-port


10.    default {device-role | hop-limit {maximum | minimum} | managed-config-flag | match {ipv6 access-list | ra prefix-list } | other-config-flag | router-preference maximum| trusted-port}


11.    do show ipv6 nd raguard policy policy_name

Switch# configure terminal

Switch(config)# ipv6 nd raguard policy example_policy

Switch(config-nd-raguard)# device-role switch

Switch(config-nd-raguard)# hop-limit maximum 33

Switch(config-nd-raguard)# managed-config-flag on

Switch(config-nd-raguard)# match ipv6 access-list example_list

Switch(config-nd-raguard)# other-config-flag on 

Switch(config-nd-raguard)# router-preference maximum high 

Switch(config-nd-raguard)# trusted-port

Switch(config-nd-raguard)# default hop-limit

Switch(config-nd-raguard)# do show ipv6 nd raguard policy example_policy

1.    configure terminal


2.    [no]ipv6 dhcp guard policy policy-name


3.    [no]device-role {client | server}


4.    [no] match server access-list ipv6-access-list-name


5.    [no] match reply prefix-list ipv6-prefix-list-name


6.    [no]preference{ max limit | min limit }


7.    [no] trusted-port


8.    default {device-role | trusted-port}


9.    do show ipv6 dhcp guard policy policy_name

Switch# configure terminal

Switch(config)# ipv6 dhcp guard policy example_policy

Switch(config-dhcp-guard)# device-role server

;;Assume a preconfigured IPv6 Access List as follows:
Switch(config)# ipv6 access-list my_acls
Switch(config-ipv6-acl)# permit host FE80::A8BB:CCFF:FE01:F700 any
 
;;configure DCHPv6 Guard to match approved access list.
Switch(config-dhcp-guard)#  match server access-list my_acls  

;;Assume a preconfigured IPv6 prefix list as follows:
Switch(config)# ipv6 prefix-list my_prefix permit 2001:0DB8::/64 le 128

;; Configure DCHPv6 Guard to match prefix
Switch(config-dhcp-guard)#  match reply prefix-list my_prefix 

Switch(config-dhcp-guard)# preference max 250
Switch(config-dhcp-guard)#preference min 150

Switch(config-dhcp-guard)# trusted-port

Switch(config-dhcp-guard)# default device-role

Switch(config-dhcp-guard)# do show ipv6 dhcp guard policy example_policy

enable
configure terminal
ipv6 access-list acl1
 permit host FE80::A8BB:CCFF:FE01:F700 any
ipv6 prefix-list abc permit 2001:0DB8::/64 le 128	
ipv6 dhcp guard policy pol1
 device-role server
 match server access-list acl1
 match reply prefix-list abc
 preference min 0
 preference max 255
 trusted-port
interface GigabitEthernet 0/2/0
 switchport
 ipv6 dhcp guard attach-policy pol1 vlan add 1
 vlan 1
  ipv6 dhcp guard attach-policy pol1
show ipv6 dhcp guard policy pol1

1.    enable


2.    configure terminal


3.    [no] ipv6 source-guard policy policy_name


4.    [deny global-autoconf] [permit link-local] [default{. . . }] [exit] [no{. . . }]


5.    end


6.    show ipv6 source-guard policy policy_name

Switch> enable

Switch# configure terminal

Switch(config)#  ipv6 source-guard policy example_policy

Switch(config-sisf-sourceguard)#  deny global-autoconf

Switch(config-sisf-sourceguard)# end

Switch# show ipv6 source-guard policy example_policy

Apply the IPv6 Source Guard policy to an interface.

Note	To allow routing protocol control packets sourced by a link-local address when prefix guard is applied, enable the permit link-local command in the source-guard policy configuration mode.

1.    enable


2.    configure terminal


3.    [no] ipv6 source-guard policy source-guard-policy


4.    [ no ] validate address


5.    validate prefix


6.    exit


7.    show ipv6 source-guard policy [source-guard-policy]

Switch> enable

Switch# configure terminal

Switch (config)# ipv6 source-guard policy my_snooping_policy

Switch (config-sisf-sourceguard)# no validate address

Switch (config-sisf-sourceguard)# validate prefix

Switch (config-sisf-sourceguard)# exit

Switch # show ipv6 source-guard policy policy1