Another IPv6 first top security protocol
is DHCP Guard, which works very similar to DHCP
Snooping in the world of IPv4.
So without further ado, let me share with you
the configuration, we'll implement it,
chat about it to make sure you have an understanding
that this feature exists as a first top security
protocol for IPv6.
So here's the syntax, very similar to what
we did previously with the Snooping
and also the RA Guard is we are going to create a policy.
So we're creating two policies here, one called clients,
and we're saying the device role is client, which means, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we're saying the device role is client, which means,
hey, I'm not expecting you to send
any server related messages in.
And I have another role or another policy called servers,
and in that policy, I'm specifying, hey,
you're a trusted port.
So that would go on any ports where
we have a DHCP relay function or a DHCP server that
needs to send DHCP server related
messages into the network for IPv6, and then we apply it.
So we're applying the client's policy to VLAN 1.
We're going to apply the service policy
to this specific interface, which leads off to our DHCP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to this specific interface, which leads off to our DHCP
server, and then we can use show commands
to verify that they're in place.
Let's do that now.
So we'll create our client and server policy,
and let me go ahead and copy those, and we'll paste them in.
There they go.
So the client's policy and the service policy,
and then we'll apply them.
We'll apply the client's policy to VLAN 1 and we'll apply
the service policy to interface gig 00.
So we'll copy that, paste that in.
And then we can do some show commands.
So if we look at the policy for DHCP Guard for IPv6 with a show
IPv6 DHCP Guard Policy, and we can look at all the Snooping WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
IPv6 DHCP Guard Policy, and we can look at all the Snooping
policies, which are now going to include the snooping,
the RA guard, and the DHCP guard all in one fell swoop.
So I will grab that, copy that, and paste it in as well.
Another IPv6 first top security feature is called source guard,
and we're going to cover that in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.