1-5
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-25303-03
Chapter 1 Configuring IPv6 Unicast Routing
Understanding IPv6
• IPv6 DHCP Address Gleaning, page 1-6
• IPv6 ND Inspection, page 1-7
• IPv6 Device Tracking, page 1-7
• IPv6 Port-Based Access List Support, page 1-7
• IPv6 Router Advertisement Guard, page 1-7
• IPv6 Device Tracking, page 1-7
• IPv6 Source Guard, page 1-8
Note Prerequisites for Implementing First Hop Security in IPv6:
• You have configured the necessary IPv6 enabled SDM template.
• You should be familiar with the IPv6 neighbor discovery feature. For information, see
“Implementing IPv6 Addressing and Basic Connectivity” chapter of the Cisco IOS IPv6
Configuration Library on Cisco.com.
Note Restrictions for Implementing First Hop Security in IPv6:
Although visible in the command-line help strings, the IPv6 first hop security (FHS) is not supported on
the Catalyst 3750-G and 3750v2 switches. The command-line help strings are visible on these switches
to support the FHS feature in a mixed switch stack scenario where one of these switches could become
a master.
IPv6 Snooping
IPv6 snooping acts as a container policy that enables most of the features available with FHS in IPv6.
For more information, see the “Configuring an IPv6 Snooping Policy” section on page 1-20.
IPv6 First-Hop Security Binding Table
A database table of IPv6 neighbors connected to the switch is created from multiple sources of
information, For example, Neighbor Discovery Protocol (NDP) snooping and Dynamic Host
Configuration Protocol (DHCP) snooping. This database or binding table is used by various IPv6 guard
features, such as, IPv6 Neighbor Discovery (ND) Inspection (to validate the link-layer address (LLA)),
per-port address limit (to validate the IPv4 or IPv6 addresses), IPv6 device tracking (to prefix binding
of the neighbors to prevent spoofing and redirect attacks).
These categories of traffic carry information that the binding table snoops for:
• ND traffic—For more information, see the “NDP Address Gleaning” section on page 1-5.
• DHCP traffic—For more information, see the “IPv6 DHCP Address Gleaning” section on page 1-6.
• Data traffic—For more information, see the “IPv6 DHCP Address Gleaning” section on page 1-6.
NDP Address Gleaning
The NDP address gleaning feature is enabled by default when you configure the ipv6 snooping policy
global configuration command. To disable this function, enter the no protocol ndp global configuration
command and attach the policy to the target port or VLAN.
To Next Page
Loading...
Need help?
General
