hop-limit
To verify the advertised hop-count limit, use the hop-limit command in RA guard policy configuration mode.
hop-limit {maximum| minimum } limit
Syntax Description
Verifies that the hop-count limit is lower than that set
by the limit argument.
maximum limit
Verifies that the hop-count limit is greater than that
set by the limit argument.
minimum limit
Command Default
No hop-count limit is specified.
Command Modes
RA guard policy configuration (config-ra-guard)
Command History
ModificationRelease
This command was introduced.8.0(1)
Usage Guidelines
The hop-limit command enables verification that the advertised hop-count limit is greater than or less than
the value set by the limit argument. Configuring the minimum limit keyword and argument can prevent an
attacker from setting a low hop-count limit value on the hosts to block them from generating traffic to remote
destinations; that is, beyond their default router. If the advertised hop-count limit value is unspecified (which
is the same as setting a value of 0), the packet is dropped.
Configuring the maximum limit keyword and argument enables verification that the advertised hop-count
limit is lower than the value set by the limit argument. If the advertised hop-count limit value is unspecified
(which is the same as setting a value of 0), the packet is dropped.
Examples
The following example shows how the command defines a router advertisement (RA) guard policy name as
raguard1, places the router in RA guard policy configuration mode, and sets a minimum hop-count limit of
3:
switch(config)# ipv6 nd raguard policy raguard1
switch(config-ra-guard)# hop-limit minimum 3
Cisco Nexus 7000 Series Security Command Reference
360
H Commands
hop-limit
To Next Page
Loading...
