328
Dynamic IPv6 source guard binding by ND snooping
configuration example
Network requirements
As shown in Figure 125, the client is connected to the device through port Ethernet 1/0/1.
Enable ND snooping on the device, establishing ND snooping entries by listening to DAD NS messages.
Enable the IPv6 source guard function on port Ethernet 1/0/1 to filter packets based on the ND
snooping entries, allowing only packets with a legally obtained IPv6 address to pass.
Figure 125 Network diagram
Configuration procedure
1. Configure ND snooping.
# In VLAN 2, enable ND snooping.
<Device> system-view
[Device] vlan 2
[Device-vlan2] ipv6 nd snooping enable
[Device-vlan2] quit
2. Configure the IPv6 source guard function.
# Configure the IPv6 source guard function on Ethernet 1/0/1 to filter packets based on both the source
IP address and MAC address.
[Device] interface ethernet 1/0/1
[Device-Ethernet1/0/1] ipv6 verify source ipv6-address mac-address
[Device-Ethernet1/0/1] quit
Verifying the configuration
# Display the IPv6 source guard binding entries generated on port Ethernet 1/0/1.
[Device] display ipv6 source binding
Total entries found: 1
MAC Address IP Address VLAN Interface Type
040a-0000-0001 2001::1 2 Eth1/0/1 ND-SNP
# Display the IPv6 ND snooping entries to see whether they are consistent with the dynamic IP source
guard entries generated on Ethernet 1/0/1.
[Device] display ipv6 nd snooping
IPv6 Address MAC Address VID Interface Aging Status
2001::1 040a-0000-0001 2 Eth1/0/1 25 Bound
---- Total entries: 1 ----
The output shows that a dynamic IPv6 source guard entry has generated on port Ethernet 1/0/1 based
on the ND snooping entry.
To Next Page
Loading...
Need help?
General