ECS4100 Series CLI Reference Guide-R07

Chapter 33 | IP Interface Commands
ND Snooping
– 936 –
ipv6 nd snooping This command enables ND snooping globally or on a specified VLAN or range of
VLANs. Use the no form to disable this feature.
Syntax
[no] ipv6 nd snooping [vlan {vlan-id | vlan-range}]
vlan-id - VLAN ID. (Range: 1-4094)
vlan-range - A consecutive range of VLANs indicated by the use a hyphen,
or a random group of VLANs with each entry separated by a comma.
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
◆ Use this command without any keywords to enable ND snooping globally on
the switch. Use the VLAN keyword to enable ND snooping on a specific VLAN or
a range of VLANs.
◆ Once ND snooping is enabled both globally and on the required VLANs, the
switch will start monitoring RA messages to build an address prefix table as
described below:
■
If an RA message is received on an untrusted interface, it is dropped. If
received on a trusted interface, the switch adds an entry in the prefix table
according to the Prefix Information option in the RA message. The prefix
table records prefix, prefix length, valid lifetime, as well as the VLAN and
port interface which received the message.
■
If an RA message is not received updating a table entry with the same
prefix for a specified timeout period, the entry is deleted.
◆ Once ND snooping is enabled both globally and on the required VLANs, the
switch will start monitoring NS messages to build a dynamic user binding table
for use in Duplicate Address Detection (DAD) or for use by other security
filtering protocols (e.g., IPv6 Source Guard) as described below:
■
If an NS message is received on an trusted interface, it is forwarded without
further processing.
show ipv6 nd snooping Shows configuration settings for ND snooping PE
show ipv6 nd snooping
binding
Shows entries in the binding table PE
show ipv6 nd snooping prefix Show entries in the prefix table PE
Table 191: ND Snooping Commands (Continued)
Command Function Mode