Cisco Catalyst 2960-X - Page 484

PurposeCommand or Action
• server—Specifies that the attached device is a DHCPv6 server.
Server messages are allowed on this port.
(Optional). Enables verification that the advertised DHCPv6 server
or relay address is from an authorized server access list (The
[no] match server access-list ipv6-access-list-name
Example:
;;Assume a preconfigured IPv6 Access List
Step 4
destination address in the access list is 'any'). If not configured, this
check will be bypassed. An empty access list is treated as a permit
all.
as follows:
Switch(config)# ipv6 access-list my_acls
Switch(config-ipv6-acl)# permit host
FE80::A8BB:CCFF:FE01:F700 any
;;configure DCHPv6 Guard to match approved
access list.
Switch(config-dhcp-guard)# match server
access-list my_acls
(Optional) Enables verification of the advertised prefixes in DHCPv6
reply messages from the configured authorized prefix list. If not
[no] match reply prefix-list ipv6-prefix-list-name
Example:
;;Assume a preconfigured IPv6 prefix list
Step 5
configured, this check will be bypassed. An empty prefix list is
treated as a permit.
as follows:
Switch(config)# ipv6 prefix-list my_prefix
permit 2001:0DB8::/64 le 128
;; Configure DCHPv6 Guard to match prefix
Switch(config-dhcp-guard)# match reply
prefix-list my_prefix
Configure max and min when device-role is serverto filter DCHPv6
server advertisements by the server preference value. The defaults
permit all advertisements.
[no]preference{ max limit | min limit }
Example:
Switch(config-dhcp-guard)# preference max
250
Switch(config-dhcp-guard)#preference min 150
Step 6
max limit—(0 to 255) (Optional) Enables verification that the
advertised preference (in preference option) is less than the specified
limit. Default is 255. If not specified, this check will be bypassed.
min limit—(0 to 255) (Optional) Enables verification that the
advertised preference (in preference option) is greater than the
specified limit. Default is 0. If not specified, this check will be
bypassed.
(Optional) trusted-port—Sets the port to a trusted mode. No further
policing takes place on the port.
[no] trusted-port
Example:
Switch(config-dhcp-guard)# trusted-port
Step 7
If you configure a trusted port then the device-role option
is not available.
Note
(Optional) default—Sets a command to its defaults.
default {device-role | trusted-port}
Example:
Switch(config-dhcp-guard)# default
device-role
Step 8
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
460 OL-29048-01
Configuring IPv6 First Hop Security
How to Configure an IPv6 DHCP Guard Policy