The next demonstration I'd like to do
is a demonstration of implementing RA Guard.
Now, router advertisements should only
come into the network on a switch on a port
by an authorized router.
So if Bob or an attacker is generating malicious router
advertisements or accidentally connects the router in,
we want the switch to squash those.
So we can create a policy for RA Guard,
we can apply it to the VLAN, and then
we can create a more specific policy for where
the actual routers are, and we can apply that policy
to the individual ports, which will allow the router WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to the individual ports, which will allow the router
advertisements in.
Now, in addition to just allowing the router
advertisements in, we can also get very specific
in the policies and say, you know
what, we want the M bit to be always set
or we want the O bit to be always set
for the flags for the router advertisers.
And then if we have that policy in place
and the router is misconfigured, it
will prevent those router advertisers
from going in because they don't match the rules of the policy.
So let's take a look at the syntax,
and then we'll look at the implementation of it.
All right, so here we go with RA Guard.
We're going to go into configuration mode, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to go into configuration mode,
we're going to create another policy called
IPv6 nd for neighbor discovery, RA Guard, that's
the keyword, keyword policy, and then we make up a name.
I'm calling his Hosts and I'm specifying
the device role of host.
That device role of host assumes many things,
including we shouldn't be seeing any RAs coming in on a VLAN
where a port has this policy applied.
Because it's not a router, it's a host,
it shouldn't be sending those in.
And then we'll create another policy,
another RA Guard policy called Routers, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
another RA Guard policy called Routers,
and then we'll say it's a trusted port.
And then here is where I'm specifying, you know what?
We want the O bit set, the O flag, the other config
flag, and that O bit, or O flag, indicates to the client, hey,
I need to go and ask DHCP for additional information.
Even though I got my own IP address,
I need a DNS server, for example.
I have other information I'd like to get.
So if the router is supposed to be marking those with the O bit
on or the O flag on, this policy,
once it's created and applied to the interface for that router
is, it would be enforcing that policy as well.
So in this syntax here, we're applying this policy to VLAN 1, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in this syntax here, we're applying this policy to VLAN 1,
and here we're applying the routers policy
through the interface.
Now on my switch, I have little exclamations
marked right here because I can dive in IPv6 question mark nd
and then space in an interface config
and it doesn't give me the rest, so not
fully baked in this version that I'm using.
So that's the syntax for it, although I
won't be able to demonstrate that exactly happening,
hence the asterisks.
And then we can do a show IPv6 snooping policies
and take a look at our snooping policies,
and now we'll also see RA Guard policies as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and now we'll also see RA Guard policies as well.
All right, so let's go ahead and configure and apply these two,
as much as we can anyways.
We'll copy that, and at the switch config,
we'll just right click and paste it in.
So there is our Host policy, there is our router policy,
here is applying the host to VLAN 1,
and here is what should work to apply
the policy for the routers to gig 0/0.
All right, then we can do a show IPv6 snooping policies. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, then we can do a show IPv6 snooping policies.
Now you can also look at the specific policies
for DHCP Guard and RA Guard, but this
is going to give us a little high level
overview of the policies.
And I can look for a specific policy, or ies.
That's what I want to do, and here we go.
We have a snooping policy for all the nodes in VLAN 1.
We have a snooping policy on a specific interface
that leads off to a server, and then
we also have a RA Guard policy that's being applied to VLAN 1.
And in our next video, I'd like to share with you the DHCP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And in our next video, I'd like to share with you the DHCP
Guard, which is very similar in function to the DHCP
snooping that we have in IPv4, except here it's IPv6,
just making sure that if we create a policy that
says you shouldn't be sending DHCP type server
messages into the network, we want
to block those at the switch.
And at the same time, if we have a real DHCP server or a DHCP
relay, we want to make sure that those ports are
able to take in DHCP server messages
to provide that functionality.
So we'll do all that in the next video. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll do all that in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.