Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Configuring Stateless IPv6 Router Advertisement Guard

 

Stateless IPv6 Router Advertisement (RA) guard enables the switch to examine incoming RA messages and filter them based on a predefined set of criteria. If the switch validates the content of the RA message, it forwards the RA message to its destination; otherwise, the RA message is dropped.

Before you can enable IPv6 RA guard, you must configure a policy with the criteria to be used for validating RA messages received on an interface. You can configure the policy to either accept or discard RA messages on the basis of whether they meet the criteria. The criteria are compared to information included in the RA messages. If the criteria for the policy includes source addresses or address prefixes, you must configure a list of the addresses before configuring the policy.

Configuring a Discard Policy for RA Guard

You can configure a discard policy to drop RA messages from predefined sources. You must first configure a list or lists of the source addresses or address prefixes, and then associate them with a policy. The following lists can be associated with discard policy:

  • source-ip-address-list

  • source-mac-address-list

  • prefix-list-name

Note

You can include more than one type of list in a discard policy. If the information contained in a received RA message matches any one of the list parameters, then that RA message is discarded.

To configure a discard policy for RA guard:

  1. Define one or more lists of disallowed source addresses or address prefixes that RA guard will use to filter incoming RA messages. Add one address or address prefix per line in the configuration.
    • To define a list of IPv6 source addresses:

      [edit]

      user@switch# set policy-options prefix-list address-list-name ipv6-address
    • To define a list of IPv6 address prefixes:

      [edit]

      user@switch# set policy-options prefix-list prefix-list-name ipv6-prefix
    • To define a list of MAC source addresses:

      [edit]

      user@switch# set policy-options mac-list address-list-name mac-address
  2. Configure the policy name:
    [edit]

    user@switch# set forwarding-options access-security router-advertisement-guard policy policy-name
  3. Specify the discard action:
    [edit forwarding-options access-security router-advertisement-guard policy policy-name]

    user@switch# set discard
  4. Associate the policy with the list or lists defined in Step 1. For example, to discard RA messages that match a source MAC address in the list:
    [edit forwarding-options access-security router-advertisement-guard policy policy-name discard]

    user@switch# set source-mac-address-list address-list-name

Configuring an Accept Policy for RA Guard

You can configure an accept policy to forward RA messages on the basis of certain criteria. You can configure either match lists of source address or address prefixes as the criteria, or you can configure other match conditions, such as hop limit, configuration flags, or router preference as the criteria.

The following lists can be associated with an accept policy by using the match-list option:

  • source-ip-address-list

  • source-mac-address-list

  • prefix-list-name

Note

You can associate more than one type of match list with an accept policy. If the match-all suboption is configured, then a received RA message must match all configured match lists in order to be forwarded; otherwise, it is discarded. If the match-any option is configured, then a received RA message must match any one of the configured match lists in order to be forwarded; if it does not match any of the configured lists, then it is discarded.

The following match conditions can be configured using the match-option option:

  • hop-limit—Configure the RA guard policy to verify the minimum or maximum hop count for an incoming RA message.

  • managed-config-flag—Configure the RA guard policy to verify that the managed address configuration flag of an incoming RA message is set.

  • other-config-flag—Configure the RA guard policy to verify that the other configuration flag of an incoming RA message is set.

  • router-preference-maximum—Configure the RA guard policy to verify that the default router preference parameter value of an incoming RA message is lower than or equal to a specified limit.

Note

The match-list and match-option options are used only in accept policies, not in discard policies.

To configure an accept policy for RA guard by using the match-list option:

  1. Define one or more lists of authorized source addresses or address prefixes that RA guard will use to filter incoming RA messages. Add one address or address prefix per line in the configuration.
    • To define a list of IPv6 source addresses:

      [edit]

      user@switch# set policy-options prefix-list address-list-name ipv6-address
    • To define a list of IPv6 address prefixes:

      [edit]

      user@switch# set policy-options prefix-list prefix-list-name ipv6-prefix
    • To define a list of MAC source addresses:

      [edit]

      user@switch# set policy-options mac-list address-list-name mac-address
  2. Specify the policy name:
    [edit]

    user@switch# set forwarding-options access-security router-advertisement-guard policy policy-name
  3. Specify the accept action:
    [edit forwarding-options access-security router-advertisement-guard policy policy-name]

    user@switch# set accept
  4. Specify whether RA guard must meet the criteria in all lists or in any of the lists configured in 1:
    • To match on all lists:

      [edit forwarding-options access-security router-advertisement-guard policy policy-name accept]

      user@switch# set match-list match-criteria match-all
    • To match on any of the lists:

      [edit forwarding-options access-security router-advertisement-guard policy policy-name accept]

      user@switch# set match-list match criteria match-any
  5. Associate the accept policy with the list or lists configured in Step 1. For example:
    [edit forwarding-options access-security router-advertisement-guard policy policy-name accept

    user@switch# set match-list source-mac-address-list address-list-name

To configure an accept policy for RA guard using the match-option option:

  1. Specify the policy name:
    [edit]

    user@switch# set forwarding-options access-security router-advertisement-guard policy policy-name
  2. Specify the accept action:
    [edit forwarding-options access-security router-advertisement-guard policy policy-name]

    user@switch# set accept
  3. Specify the match conditions by using the match-option option. For example, to specify a match on the maximum number of hops:
    [edit forwarding-options access-security router-advertisement-guard policy policy-name accept]

    user@switch# set match-option hop-limit maximum value

Enabling Stateless RA Guard on an Interface

You can enable stateless RA guard on an interface. You must first configure a policy, which is applied to incoming RA messages on the interface or interfaces. After you apply a policy to an interface, you must also enable RA guard on the corresponding VLAN; otherwise, the policy applied to the interface does not have any impact on received RA packets.

To enable stateless RA guard on an interface:

  1. Apply a policy to an interface:
    [edit]

    user@switch# set forwarding-options access-security router-advertisement-guard interface interface-name policy policy-name
  2. Configure the stateless option on the interface:
    [edit forwarding-options access-security router-advertisement-guard interface interface-name policy policy-name]

    user@switch# set stateless
  3. Enable stateless RA guard on the corresponding VLAN:
    [edit]

    user@switch# set forwarding-options access-security router-advertisement-guard vlans vlan-name policy policy-name stateless

Enabling Stateless RA Guard on a VLAN

You can enable stateless RA guard on a per-VLAN basis or for all VLANs. You must first configure a policy, which is used to validate incoming RA messages in the learning state.

To enable stateless RA guard on a specific VLAN:

  1. Apply a policy to a VLAN.
    [edit]

    user@switch# set forwarding-options access-security router-advertisement-guard vlans vlan-name policy policy-name
  2. Configure the stateless option on the VLAN:
    [edit forwarding-options access-security router-advertisement-guard vlans vlan-name policy policy-name]

    user@switch# set stateless

To enable stateless RA guard on all VLANs:

  1. Apply a policy to all VLANs.
    [edit]

    user@switch# set forwarding-options access-security router-advertisement-guard vlans all policy policy-name
    Note

    If a policy has been configured for a specific VLAN using the command set forwarding-options access-security router-advertisement-guard vlans vlan-name policy policy-name, that policy takes priority over the policy applied globally to all VLANs.

  2. Configure the stateful option on all VLANs:
    [edit forwarding-options access-security router-advertisement-guard vlans all policy policy-name]

    user@switch# set stateful

Configuring an Interface as Trusted or Blocked to Bypass Inspection by RA Guard

You can configure an interface as trusted or blocked to bypass inspection of RA messages by RA guard. When an RA message is received on a trusted or blocked interface, it is not subject to validation against the configured policy. A trusted interface forwards all RA messages. A blocked interface discards all RA messages.

  • To configure an interface as trusted:
    [edit]

    user@switch# set forwarding-options access-security router-advertisement-guard interface interface-name mark-interface trusted
  • To configure an interface as blocked:
    [edit]

    user@switch# set forwarding-options access-security router-advertisement-guard interface interface-name mark-interface block