- Introduction:
- Prerequisite:
- Configuration Example
- Network Diagram
- Verification commands
- Related Information
Introduction:
In a typical share layer-2 IPv6 network, there is always the risk of facing operational problems as all connected devices operates without Complete Secure Neighbor Discovery (SEND) and it may lead to Rogue Router Advertisements (RA's). This RA's can be rouge router advertisements that are generated maliciously or unintentionally by unauthorized or improperly configured routers connecting to that segment. The RA Guard feature analyzes these RAs and filters out bogus RAs sent by unauthorized routers.
Prerequisite:
Understanding of IPv6 neighbor Discovery process.
Configuration Steps
A) IPv6 global policies: IPv6 RA guard is IPv6 global policies features, When RA guard is configured globally, attributes of the policy are stored in the software policy database. The policy is then applied to an interface.
SW1(config)#ipv6 nd inspection policy policy-name
B) Device role need to be set on the device:
There are generally two modes:
1) In host mode (default), all router advertisement and router redirect messages are disallowed on the port.
2) In router mode, all messages (router solicitation [RS], router advertisement [RA], or redirect) are allowed on this port.
SW1(config-nd-inspection)#device-role{host | router}
C) Applying IPv6 RA Guard on a Specified Interface:
SW1(config)#interface type number
SW1(config-if)#ipv6 nd raguard attach-policy [policy-name]
D) Optional:
1) You can also match ipv6 access-list or Prefix-list command enables verification of the sender's IPv6 address in inspected messages from the configured authorized router source access list. If the matchipv6 access-list or prefix-list command is not configured, this authorization is bypassed.
SW1(config-ra-guard)#match ipv6 access-list ipv6-access-list-name
SW1(config-ra-guard)#match ra prefix-list ipv6-prefix-list-name
2) The router-preference maximum command limit is high, medium, or low. If, for example, this value is set to medium and the advertised default router preference is set to high in the received packet, then the packet is dropped. If the command option is set to medium or low in the received packet, then the packet is not dropped.
SW1(config-ra-guard)#router-preference maximum {high | low | medium}
Configuration Example
In this Example we will go to see how Ipv6 RAGuards work on the L2 network segment.
R1 Gig0/0 is directly connected to L2 port Gig0/1 of Switch SW1 Configured in Vlan 5.
We have also configured interface Vlan 5 in autoconfig mode on the switch SW1 and it is acquiring IPv6 address from R1.
Initially R1 will be advertising RAs on to its Lan Segment, so that interface vlan 5 of SW1 will get IPv6 address.
Link-local IPV6address R1 :fe80::1
SW1:fe80::2
Network Diagram
Base Initial configuration
SW1R1
hostname SW1 vlan 5 name RA | hostname R1 no ip address
|
configuring ipv6 Ragaurd on the Sw1 in Host mode:
SW1(config)#ipv6 nd raguard policy RAGUARD
SW1(config-nd-raguard)#device-role host
SW1(config-nd-raguard)#exit
SW1(config)#int gig0/1
SW1(config-if)#ipv6 nd raguard attach-policy RAGUARD
Verification of RAguard policy in host mode:
SW1#sh ipv6 nd raguard policy RAGUARD
Policy RAGUARD configuration:
device-role host
Policy RAGUARD is applied on the following targets:
Target Type Policy Feature Target range
Gi0/1 PORT RAGUARD RA guard vlan all
To verify this policy more closely we are debugging the ND messages on the switch and collecting those logs into system buffer. From the below output we can see that sw1 is not accepting RA received on the interface gig0/1 so that’s why interface vlan 5 will not get ipv6 address.
SW1#sh logging | in RA
*Mar 1 00:59:50.995: ICMPv6-ND: Created RA context for FE80::2/Vlan5
*Mar 1 00:59:50.995: ICMPv6-ND: Request to send RA for FE80::2
*Mar 1 00:59:50.995: ICMPv6-ND: Setup RA from FE80::2 to FF02::1 on Vlan5
*Mar 1 01:00:07.051: ICMPv6-ND: Request to send RA for FE80::2
*Mar 1 01:00:07.051: ICMPv6-ND: Setup RA from FE80::2 to FF02::1 on Vlan5
*Mar 1 01:00:23.098: ICMPv6-ND: Request to send RA for FE80::2
*Mar 1 01:00:23.098: ICMPv6-ND: Setup RA from FE80::2 to FF02::1 on Vlan5
SW1#sh ipv6 interface vlan 5
Vlan5 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::2
No Virtual link-local address(es):
Stateless address autoconfig enabled
No global unicast address is configured
Joined group address(es):
FF02::1
FF02::2
FF02::1:FF00:2
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ICMP unreachables are sent
Output features: Check hwidb
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (using 30000)
ND advertised reachable time is 0 (unspecified)
ND advertised retransmit interval is 0 (unspecified)
ND router advertisements are sent every 200 seconds
ND router advertisements live for 1800 seconds
ND advertised default router preference is Medium
Hosts use stateless autoconfig for addresses.
Configuring ipv6 Ragaurd on the Sw1 in router mode, additionally we will configure ipv6 access-list to enables verification of the sender's IPv6 address.
SW1(config)#ipv6 access-list RAGUARD
SW1(config-ipv6-acl)#permit ipv6 host fe80::1 any
SW1(config-ipv6-acl)#exit
SW1(config)#ipv6 nd raguard policy RAGUARD
SW1(config-nd-raguard)#device-role router
SW1(config-nd-raguard)#match ipv6 access-list RAGUARD
The below output shows, packets are matched on the applied access-list, also shows that interface vlan 5 is getting ipv6 address due to RA is verified by the policy applied on the interface gig0/1.We can also able to see in buffer logs that RA is accepted by switch.
SW1#sh ipv6 access-list
IPv6 access list RAGUARD
permit ipv6 host FE80::1 any (1 match) sequence 10
SW1#sh ipv6 interface vlan 5
Vlan5 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::2
No Virtual link-local address(es):
Stateless address autoconfig enabled
Global unicast address(es):
2001::2, subnet is 2001::/64 [EUI/CAL/PRE]
valid lifetime 2591969 preferred lifetime 604769
Joined group address(es):
FF02::1
FF02::2
FF02::1:FF00:2
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ICMP unreachables are sent
Output features: Check hwidb
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (using 30000)
SW1(config-if)#do sh logging | in RA
*Mar 1 00:59:50.995: ICMPv6-ND: Created RA context for FE80::2/Vlan5
*Mar 1 00:59:50.995: ICMPv6-ND: Request to send RA for FE80::2
*Mar 1 03:09:45.035: ICMPv6-ND: Received RA from FE80::1 on Vlan5
Verification commands
1) Use "Show ipv6 nd ragaurd policy" command to verify Policy.
SW1#sh ipv6 nd raguard policy RAGUARD
Policy RAGUARD configuration:
device-role router
match ipv6 access-list RAGUARD
Policy RAGUARD is applied on the following targets:
Target Type Policy Feature Target range
Gi0/1 PORT RAGUARD RA guard vlan all
2) To Displays all RA Guard installed capture rules use "show ipv6 snooping capture-policy int <interface-no>" command.
3) For Troublshooting you can use "debug ipv6 snooping raguard" command under exec mode.
4) To display dropped packets by RA guard use "show ipv6 snooping counters int <name>" command.
Related Information
IPv6 Router Advertisement Guard
Rogue IPv6 Router Advertisement Problem Statement
Base Initial configuration:
