CLI Reference Guide-R04

Chapter 9 | General Security Measures
IPv6 Source Guard
– 361 –
◆ If IPv6 source guard is enabled, an inbound packet’s source IPv6 address will be
checked against the binding table. If no matching entry is found, the packet
will be dropped.
◆ Filtering rules are implemented as follows:
■
If ND snooping and DHCPv6 snooping are disabled, IPv6 source guard will
check the VLAN ID, source IPv6 address or address prefix, and port number.
If a matching entry is found in the binding table and the entry type is static
IPv6 source guard binding, the packet will be forwarded.
■
If ND snooping or DHCPv6 snooping is enabled, IPv6 source guard will
check the VLAN ID, source IP address or address prefix, and port number. If
a matching entry is found in the binding table and the entry type is static
IPv6 source guard binding, dynamic ND snooping binding, or dynamic
DHCPv6 snooping binding, the packet will be forwarded.
■
If IPv6 source guard is enabled on an interface for which IPv6 source
bindings (dynamically learned via ND snooping or DHCPv6 snooping, or
manually configured) are not yet configured, the switch will drop all IPv6
traffic on that port, except for ND packets and DHCPv6 packets allowed by
DHCPv6 snooping.
■
Only IPv6 global unicast addresses are accepted for static bindings.
Example
This example enables IP source guard on port 5.
Console(config)#interface ethernet 1/5
Console(config-if)#ipv6 source-guard sip
Console(config-if)#
Related Commands
ipv6 source-guard binding (358)
ipv6 dhcp snooping (341)
ipv6 dhcp snooping vlan (345)