Dynamic IPv6 source guard using ND snooping configuration example
Network requirements
As shown in Figure 103, enable ND snooping on the device, establishing ND snooping entries by listening to DAD NS messages.
Enable the IPv6 source guard feature on Ethernet 1/0/1 to filter packets based on the ND snooping entries, allowing only packets with a legally obtained IPv6 address to pass.
Figure 103: Network diagram
Configuration procedure
Configure ND snooping:
# In VLAN 2, enable ND snooping.
<Device> system-view [Device] vlan 2 [Device-vlan2] ipv6 nd snooping enable [Device-vlan2] quit
Configure the IPv6 source guard feature:
# Configure the IPv6 source guard feature on Ethernet 1/0/1 to filter packets based on both the source IP address and MAC address.
[Device] interface ethernet 1/0/1 [Device-Ethernet1/0/1] ipv6 verify source ipv6-address mac-address [Device-Ethernet1/0/1] quit
Verifying the configuration
# Display the IPv6 source guard binding entries generated on Ethernet 1/0/1.
[Device] display ipv6 source binding Total entries found: 1 MAC Address IP Address VLAN Interface Type 040a-0000-0001 2001::1 2 Eth1/0/1 ND-SNP
# Display all ND snooping entries.
[Device] display ipv6 nd snooping IPv6 Address MAC Address VID Interface Aging Status 2001::1 040a-0000-0001 2 Eth1/0/1 25 Bound ---- Total entries: 1 ----
The output shows that a dynamic IPv6 source guard binding entry has generated on Ethernet 1/0/1 based on the ND snooping entry.