To really appreciate IPv6 First Hop Security,
let's take a look at the default behaviors for IPv6,
where it's vulnerable, and then how some of these security
measures can help us.
So let's start with this topology.
Here we have a client and a router, a match made in heaven.
And they are on the same VLAN.
And this router has been enabled with an IPv6 address
on this interface.
It's been enabled for IPv6 unicast routing.
And what it's going to do, it's going
to advertise RAs periodically.
Based on the iOS, whatever the default is,
you can also tweak those.
Now an RA's a router advertisement. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now an RA's a router advertisement.
And it says things like, hey, this is the network.
This is 2020:5::/64.
Ta da.
Or if a client boots up and it can do a router solicitation,
which goes to the all routers address
and then the router would hear that and then trigger
a router advertisement saying what network
it is and the client could see that and go ahead and configure
its own IP address using whatever method
it's configured to use, like Slack or EUI 64
or whatever it is, and get on the network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or whatever it is, and get on the network.
Ta da.
Life is good.
Now what if somebody was connected to the network,
let's call it Bob, and Bob has a hacking tool, which
are very easy to come by.
And it's software running on his PC.
And he starts advertising router advertisements.
And he starts claiming it's a different network.
We probably want the switch, if we could,
to have some type of a First Hop security mechanism that
would say, hey, wait a sec.
This traffic coming out of this port,
there shouldn't be any router advertisers
coming in this port.
Everybody, VLAN 1 except for this guy, you're all clients. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Everybody, VLAN 1 except for this guy, you're all clients.
And so we could actually set up policy that says,
hey, router advertisers are not allowed except for these ports.
And furthermore, we could also on a port,
we could specify in policy with the first hop security,
we could specify that the M flag, which
means we're going to get an IP address assigned via DHCP,
is set.
Or the O flag, which is other options, like a DNS server.
We could configure policy based on what should be allowed
or not allowed as far as the router
advertisements on that port.
And then, even if you get a rogue router, somebody WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then, even if you get a rogue router, somebody
who's not configured correctly, the switch
can go ahead and drop those.
So the switch is going to drop all the router advertisements
coming from the hacker.
It's also going to drop any bogus or router advertisements
that are not aligned correctly with what
we should have had set up on our one to begin with.
So that's an example of doing first hop security.
And that feature is called RA Guard.
All right.
So that's just one of several first hop security measures
in IPv6 is RA Guard.
Another challenge is if we're using DHCP, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Another challenge is if we're using DHCP,
and this is DHCP to assign an IP address
or just to hand out DNS information,
we don't want Bob the attacker to be responding to those DHCP
messages if he's not the authorized device.
So we also have a thing in IPv6 for first hop security called
a DHCP guard that we can create policies, one applied
to the VLAN that says, hey, we don't trust any of these ports,
and one that we apply to the port that leads to the DHCP
server.
It can also be the relay agent interface there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It can also be the relay agent interface there.
And we can go ahead and specify, yes, that's a trusted port.
Now if DHCP guard sounds like DHCP snooping, you'd be right.
It's very similar to control which devices can send server
type messages into the network.
Now in addition, there is a thing called IPv6 snooping.
Now it's not DHCP snooping.
DHCP guard has that feature.
But IPv6 snooping is when we can analyze and make
it dynamically build a database of the IPv6 addresses WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it dynamically build a database of the IPv6 addresses
and the Mac addresses so that if somebody starts
trying to lie, let's say that another attacker, we'll
call our Lois, let's imagine that Lois is trying
to fool this client into sending traffic her way,
that she is the next hopper.
That's her IP address.
With the IPv6 snooping we can create a binding table.
A binding table is just a mapping
of IPv6 to layer two addresses.
And in that binding table, we can train the switch to say,
wait a sec, you can only have so many addresses. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
wait a sec, you can only have so many addresses.
You can't have 50 or 100 or 200 addresses associated
with that single Mac address.
We can set limits.
And as it learns Mac addresses dynamically
through IPv6 snooping, just through the normal neighbor
discovery messages are going on like duplicate address
detection and other messages going back and forth,
it can build a trusted table.
And if somebody tries to jump in over from left field or right
field or whatever field they're coming in from,
and tries to lie, trying to redirect somebody
to another path, the switch can say wait a sec, wait a sec,
I have this binding table that I've built dynamically. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I have this binding table that I've built dynamically.
And we can also statically add entries to it
as well, if we need to.
And this address you're coming from,
with this Mac address over here, that's not correct.
That exists elsewhere in the topology.
I just saw them.
I know it's true.
So it can block the switch and block that traffic at the port.
And deny it from ever getting into the network.
And that feature we call IPv6 source guard.
We have some new dynamic learning
options with IPv6 snooping and new features like RA guard. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
options with IPv6 snooping and new features like RA guard.
So our objective is this set of videos
is for us to be able to describe several of the IPv6 first hop
security features.
And so to do that, what I thought we'd do
is let's go through the next several videos,
and we'll take just one or two of the features.
We'll do a quick demo so you can get a feel for it.
And then we'll continue through.
So I'll see you in the next video as we take a look
and demonstrate IPv6 snooping on a Cisco Catalyst switch.
I'll see you in that video in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'd like to thank you for viewing.