Tweet
I. Mô tả
Tính năng RA guard sẽ giúp lọc những Router Advertisement message đến từ nguồn không xác thực ( Rouge RA). Tính năng này cấu hình trên Switch ở một số ios nhất định ( không hỗ trợ lệnh trên 1 số dòng switch).
II. Cấu hình
Cấu hình căn bản cho router R1:
Code:
R1(config)#[B]ipv6 unicast-routing[/B] R1(config)#[B]int e0/0[/B] R1(config-if)#[B]no ip add[/B] R1(config-if)#[B]ipv6 add FE80::1 link-local[/B] R1(config-if)#[B]ipv6 add 2001::1/64[/B]
Code:
SW1(config)#[B]vlan 5[/B] SW1(config-vlan)#[B]name RA[/B] SW1(config)#[B]int e0/0[/B] SW1(config-if)#[B]switchport mode access[/B] SW1(config-if)#[B]switchport access vlan 5[/B]
Code:
SW1(config)#i[B]nt vlan 5[/B] SW1(config-if)#i[B]pv6 address FE80::2 link-local[/B] SW1(config-if)#[B]ipv6 address autoconfig[/B]
Code:
SW1(config)#[B]ipv6 neighbor binding vlan 5 2001::/64 int e0/0[/B] SW1(config)#[B]ipv6 neighbor binding max-entries 200[/B]
Code:
SW1#[B]show ipv6 neighbor binding[/B]
Binding Table has 1 entries, 0 dynamic (limit 200)
Codes: L - Local, S - Static, ND - Neighbor Discovery, DH - DHCP, PKT - Other Packet, API - API created
Preflevel flags (prlvl):
0001:MAC and LLA match 0002:Orig trunk 0004:Orig access
0008:Orig trusted trunk 0010:Orig trusted access 0020:DHCP assigned
0040:Cga authenticated 0080:Cert authenticated 0100:Statically assigned
IPv6 address Link-Layer addr Interface vlan prlvl age state Time left
S 2001::/64 any Et0/0 5 0100 24s REACHABLE
Code:
SW1(config)#[B]ipv6 nd raguard policy RAGUARD[/B] SW1(config-nd-raguard)#[B]device-role host[/B] SW1(config-nd-raguard)#[B]exit[/B] SW1(config)#i[B]nt e0/0[/B] SW1(config-if)#[B]ipv6 na raguard attach-policy RAGUARD[/B]
Code:
SW1#[B]show ipv6 nd raguard policy RAGUARD[/B] Policy RAGUARD configuration: device-role host Policy RAGUARD is applied on the following targets: Target Type Policy Feature Target range Et0/0 [B] PORT RAGUARD [/B] [B]RA guard[/B] vlan all
Code:
SW1#[B]show ipv6 int vlan 5[/B]
Vlan5 is [B]up[/B], line protocol is [B]up[/B]
[B]IPv6 is enabled[/B], link-local address is FE80::2
[B] No Virtual link-local address(es):[/B]
[B]Stateless address autoconfig enabled[/B]
No global unicast address is configured
Joined group address(es):
FF02::1
FF02::2
FF02::1:FF00:2
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ICMP unreachables are sent
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (using 30000)
ND advertised reachable time is 0 (unspecified)
ND advertised retransmit interval is 0 (unspecified)
ND router advertisements are sent every 200 seconds
ND router advertisements live for 1800 seconds
ND advertised default router preference is Medium
[B]Hosts use stateless autoconfig for addresses[/B].
Comment