Device# configure terminal

Enters the global configuration mode.

Device(config)# device-tracking policy example_policy

Enters the device-tracking configuration mode.

Enables the following options for both IPv4 and IPv6:

• (Optional) device-role{node | switch}—Specifies the role of the device attached to the port. Default is node.

• (Optional) limit address-count value—Limits the number of addresses allowed per target.

• (Optional) no—Negates a command or sets it to defaults.

• (Optional) destination-glean{recovery| log-only}[dhcp]}—Enables binding table recovery by data traffic source address gleaning.

• (Optional) data-glean{recovery| log-only}[dhcp | ndp]}—Enables binding table recovery using source or data address gleaning.

• (Optional) security-level{glean|guard|inspect}—Specifies the level of security enforced by the feature. Default is guard.

  • glean—Gleans addresses from messages, and populates the binding table without any verification.
  • guard—Gleans addresses and inspects messages. In addition, it rejects Router Advertisement (RA) and DHCP server messages. This is the default option.
  • inspect—Gleans addresses, validates messages for consistency and conformity, and enforces address ownership.

• (Optional) tracking {disable | enable}—Specifies a tracking option.

• (Optional) trusted-port—Sets up a trusted port. Disables the guard on applicable targets. Bindings learned through a trusted port have preference over bindings learned through any other port. A trusted port is given preference in case of a collision while making an entry in the table.

Device(config-device-tracking)# exit

Exits configuration mode.

Device#show device-tracking policy example_policy

Displays the device-tracking policy configuration.

Device# configure terminal

Enters the global configuration mode.

Device(config)# ipv6 snooping policy example_policy

Creates a snooping policy and enters IPv6 Snooping Policy Configuration mode.

Enables data address gleaning, validates messages against various criteria, specifies the security level for messages.

• (Optional) default—Sets all to default options.

• (Optional) device-role{node] | switch}—Specifies the role of the device attached to the port. Default is node.

• (Optional) limit address-count value—Limits the number of addresses allowed per target.

• (Optional) no—Negates a command or sets it to defaults.

• (Optional) protocol{dhcp | ndp}—Specifies which protocol should be redirected to the snooping feature for analysis. The default, is dhcp and ndp. To change the default, use the no protocol command.

• (Optional) security-level{glean|guard|inspect}—Specifies the level of security enforced by the feature. Default is guard.

  • glean—Gleans addresses from messages and populates the binding table without any verification.
  • guard—Gleans addresses and inspects messages. In addition, it rejects RA and DHCP server messages. This is the default option.
  • inspect—Gleans addresses, validates messages for consistency and conformance, and enforces address ownership.

• (Optional) tracking {disable | enable}—Overrides the default tracking behavior and specifies a tracking option.

• (Optional) trusted-port—Sets up a trusted port. It disables the guard on applicable targets. Bindings learned through a trusted port have preference over bindings learned through any other port. A trusted port is given preference in case of a collision while making an entry in the table.

Device(config-ipv6-snooping)# exit

Exits configuration modes to Privileged EXEC mode.

Device#show ipv6 snooping policy example_policy

Displays the snooping policy configuration.

Device# configure terminal

Enters the global configuration mode.

Device(config)#  ipv6 neighbor binding 

Adds a static entry to the binding table database.

Device(config)#  ipv6 neighbor binding max-entries 30000

Specifies the maximum number of entries that are allowed to be inserted in the binding table cache.

Device(config)# ipv6 neighbor binding logging  

Enables the logging of binding table main events.

Device(config)# exit   

Exits global configuration mode, and places the router in privileged EXEC mode.

Device#  show ipv6 neighbor binding  

Displays contents of a binding table.

Device# configure terminal

Enters the global configuration mode.

Device(config)# ipv6 nd inspection policy example_policy

Specifies the ND inspection policy name and enters ND Inspection Policy configuration mode.

Device(config-nd-inspection)# device-role switch

Specifies the role of the device attached to the port. The default is host.

Device(config-nd-inspection)# drop-unsecure

Drops messages with no or invalid options or an invalid signature.

Device(config-nd-inspection)# limit address-count 1000

Enter 1–10,000.

Device(config-nd-inspection)# limit address-count 1000

Specifies the minimum security level parameter value when Cryptographically Generated Address (CGA) options are used.

Device(config-nd-inspection)# tracking disable stale-lifetime infinite

Overrides the default tracking policy on a port.

Device(config-nd-inspection)# trusted-port

Configures a port to become a trusted port.

Device(config-nd-inspection)# validate source-mac

Checks the source media access control (MAC) address against the link-layer address.

Device(config-nd-inspection)# no validate source-mac

Remove the current configuration of a parameter with the no form of the command.

Device(config-nd-inspection)# default limit address-count

Restores configuration to the default values.

Device(config-nd-inspection)# do show ipv6 nd inspection policy example_policy

Verifies the ND Inspection Configuration without exiting ND inspection configuration mode.

Device# configure terminal

Enters the global configuration mode.

Device(config)# ipv6 nd raguard policy example_policy

Specifies the RA Guard policy name and enters RA Guard Policy configuration mode.

Device(config-nd-raguard)# device-role switch

Specifies the role of the device attached to the port. The default is host.

Device(config-nd-raguard)# hop-limit maximum 33

(1–255) Range for Maximum and Minimum Hop Limit values.

Enables filtering of Router Advertisement messages by the Hop Limit value. A rogue RA message may have a low Hop Limit value (equivalent to the IPv4 Time to Live) that when accepted by the host, prevents the host from generating traffic to destinations beyond the rogue RA message generator. An RA message with an unspecified Hop Limit value is blocked.

If not configured, this filter is disabled. Configure minimum to block RA messages with Hop Limit values lower than the value you specify. Configure maximumto block RA messages with Hop Limit values greater than the value you specify.

Device(config-nd-raguard)# managed-config-flag on

Enables filtering of Router Advertisement messages by the Managed Address Configuration, or "M" flag field. A rouge RA message with an M field of 1 can cause a host to use a rogue DHCPv6 server. If not configured, this filter is disabled.

On—Accepts and forwards RA messages with an M value of 1, blocks those with 0.

Off—Accepts and forwards RA messages with an M value of 0, blocks those with 1.

Device(config-nd-raguard)# match ipv6 access-list example_list

Matches a specified prefix list or access list.

Device(config-nd-raguard)# other-config-flag on 

Enables filtering of Router Advertisement messages by the Other Configuration, or "O" flag field. A rouge RA message with an O field of 1 can cause a host to use a rogue DHCPv6 server. If not configured, this filter is disabled.

On—Accepts and forwards RA messages with an O value of 1, blocks those with 0.

Off—Accepts and forwards RA messages with an O value of 0, blocks those with 1.

Device(config-nd-raguard)# router-preference maximum high 

Enables filtering of Router Advertisement messages by the Router Preference flag. If not configured, this filter is disabled.

• high—Accepts RA messages with the Router Preference set to high, medium, or low.

• medium—Blocks RA messages with the Router Preference set to high.

• low—Blocks RA messages with the Router Preference set to medium and high.

Device(config-nd-raguard)# trusted-port

When configured as a trusted port, all attached devices are trusted, and no further message verification is performed.

Device(config-nd-raguard)# default hop-limit

Restores a command to its default value.

Device(config-nd-raguard)# do show ipv6 nd raguard policy example_policy

(Optional)—Displays the ND Guard Policy configuration without exiting the RA Guard policy configuration mode.

Device# configure terminal

Enters the global configuration mode.

Device(config)# ipv6 dhcp guard policy example_policy

Specifies the DHCPv6 Guard policy name and enters DHCPv6 Guard Policy configuration mode.

Device(config-dhcp-guard)# device-role server

(Optional) Filters out DHCPv6 replies and DHCPv6 advertisements on the port that are not from a device of the specified role. Default is client.

• client—Default value, specifies that the attached device is a client. Server messages are dropped on this port.

• server—Specifies that the attached device is a DHCPv6 server. Server messages are allowed on this port.

;;Assume a preconfigured IPv6 Access List as follows:
Device(config)# ipv6 access-list my_acls
Device(config-ipv6-acl)# permit host FE80::A8BB:CCFF:FE01:F700 any
 
;;configure DCHPv6 Guard to match approved access list.
Device(config-dhcp-guard)#  match server access-list my_acls  

(Optional). Enables verification that the advertised DHCPv6 server or relay address is from an authorized server access list (The destination address in the access list is 'any'). If not configured, this check will be bypassed. An empty access list is treated as a permit all.

;;Assume a preconfigured IPv6 prefix list as follows:
Device(config)# ipv6 prefix-list my_prefix permit 2001:0DB8::/64 le 128

;; Configure DCHPv6 Guard to match prefix
Device(config-dhcp-guard)#  match reply prefix-list my_prefix 

(Optional) Enables verification of the advertised prefixes in DHCPv6 reply messages from the configured authorized prefix list. If not configured, this check will be bypassed. An empty prefix list is treated as a permit.

Device(config-dhcp-guard)# preference max 250
Device(config-dhcp-guard)#preference min 150

Configure max and min when device-role is serverto filter DCHPv6 server advertisements by the server preference value. The defaults permit all advertisements.

max limit—(0 to 255) (Optional) Enables verification that the advertised preference (in preference option) is less than the specified limit. Default is 255. If not specified, this check will be bypassed.

min limit—(0 to 255) (Optional) Enables verification that the advertised preference (in preference option) is greater than the specified limit. Default is 0. If not specified, this check will be bypassed.

Device(config-dhcp-guard)# trusted-port

(Optional) trusted-port—Sets the port to a trusted mode. No further policing takes place on the port.

Device(config-dhcp-guard)# default device-role

(Optional) default—Sets a command to its defaults.

Device(config-dhcp-guard)# do show ipv6 dhcp guard policy example_policy

(Optional) Displays the configuration of the IPv6 DHCP guard policy without leaving the configuration submode. Omitting the policy_name variable displays all DHCPv6 policies.

Device> enable

Enables privileged EXEC mode. Enter your password if prompted.

Device# configure terminal

Enters the global configuration mode.

Device(config)#  ipv6 source-guard policy example_policy

Specifies the IPv6 Source Guard policy name and enters IPv6 Source Guard policy configuration mode.

Device(config-sisf-sourceguard)#  deny global-autoconf

(Optional) Defines the IPv6 Source Guard policy.

• deny global-autoconf—Denies data traffic from auto-configured global addresses. This is useful when all global addresses on a link are DHCP-assigned and the administrator wants to block hosts with self-configured addresses to send traffic.

• permit link-local—Allows all data traffic that is sourced by a link-local address.

Device(config-sisf-sourceguard)# end

Exits out of IPv6 Source Guard policy configuration mode.

Device# show ipv6 source-guard policy example_policy

Shows the policy configuration and all the interfaces where the policy is applied.

Device> enable

Enables privileged EXEC mode. Enter your password if prompted.

Device# configure terminal

Enters the global configuration mode.

Device (config)# ipv6 source-guard policy my_snooping_policy

Defines an IPv6 source-guard policy name and enters switch integrated security features source-guard policy configuration mode.

Device (config-sisf-sourceguard)# no validate address

Disables the validate address feature and enables the IPv6 prefix guard feature to be configured.

Device (config-sisf-sourceguard)# validate prefix

Enables IPv6 source guard to perform the IPv6 prefix-guard operation.

Device (config-sisf-sourceguard)# exit

Exits switch integrated security features source-guard policy configuration mode and returns to privileged EXEC mode.

Device # show ipv6 source-guard policy policy1

Displays the IPv6 source-guard policy configuration.