Now to get the ball rolling with IPv6 first top security,
the switch has to know, OK, what Layer 3 IPv6
addresses are associate with the Layer 2 Mac address.
I mean, if we're ever going to inspect and look later and see
if there's something coming in from a wrong location,
it needs to have that database.
And the easiest way to get that--
well, you could do it statically.
We can manually put the entries in,
but that's not very feasible.
The better way is to use literally
IPv6 Snooping, which is listening
to the traffic including neighbor discovery and all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to the traffic including neighbor discovery and all
the messages and building dynamically
this trusted binding table that it can then refer to.
So we're going to start with IPv6 Snooping,
and we're going to create two policies.
We'll create one that's specific for clients,
maybe we lop that at the VLAN, and then
we create one that's specific for maybe
routers or other servers, and we can apply that policy
with those permissions regarding snooping to specific ports.
And our objective in this set of videos
is to describe several of the IPv6 first top security
measures we can take, and one of those WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
measures we can take, and one of those
is building the binding table of the addresses.
So if we go into configuration mode and we create a policy
called Nodes.
Now Nodes is just a name, and then there's several options
that we can specify in that policy based on what you want
to track and how lenient or how strict you want to be,
for example, limit address count of five.
So anybody who has this policy applied to it
won't be able to have more than five addresses, trusted
addresses, associated with one Layer 2 address.
And then we can specify different levels of security
regarding this policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
regarding this policy.
And then this policy is just sitting here,
doesn't really do anything until we apply it.
That's what this is coming up.
This is VLAN configuration one for VLAN 1
and then IPv6 Snooping attach policy,
and we're attaching that policy.
Now this policy applies to everybody in the VLAN.
Now if you have servers or devices
that you want slightly different policy for them,
you can make another policy, like we
have here, IPv6 snooping policy for server,
that wherever this policy is applied it's a trusted port.
We're going to disable tracking, and then we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to disable tracking, and then we
could go to the specific interface
and apply that policy with IPv6 Snooping attach policy server.
So if there's one policy for the VLAN
and then a more specific policy for an interface,
the interface policy takes precedence.
So this is how we set up IPv6 snooping for a VLAN
and yet for a more specific policy for individual ports.
And I thought it'd be fun to go ahead and actually apply this
so we can see it work.
So let me take off that and just grab this config,
and so let's play this one first. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and so let's play this one first.
This is creating the policy called Nodes
and applying it to VLAN 1.
So I'll copy it, go to a switch that supports this.
By the way, this is no small task either,
so IPv6, although it's been around for a long time,
not completely supported with all
of its features in every version of IOS on a switch.
So what I'm going to be demonstrating here
is supported, and the commands based on the switch
may be slightly different.
In face, let me go ahead and change that font--
or change the colors a little bit.
Let me go to Global. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let me go to Global.
There we go.
Make it a bit more normal for us.
All right, so there's our policies applied to the VLAN,
and now let's go ahead and create a second policy
called Server, which has some different parameters
like a trusted port, and we'll apply
that to interface gig 0/0.
And then we can do a show IPv6 snooping policies
and take a look at the result. All right, and here we go.
So for our IPv6 snooping policies,
we've got one applied to VLAN 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we've got one applied to VLAN 1.
It's that policy called Nodes.
The feature is snooping, so it can dynamically
build the binding table with the addresses.
And then we have one that's specifically
applied to an interface, and that's the one called Server.
But they're both snooping policies.
Now, having this snooping policy or manually configuring
all the bindings, either way you slice it,
or a combination of both, is an important prerequisite
to implementing the other features, including features
like RA Guard and DHCP Guard.
So in the next video, we'll kick it up a notch,
and I'll leave this as is, and we'll simply WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I'll leave this as is, and we'll simply
add to it the additional feature of RA Guard coming right up.
So meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.