If a device all of a sudden shows up
with its IPv6 addresses, starts sending packets
with some wacky or interesting source address
that the switch has not learned yet
and didn't see any kind of neighbor discovery
or DHCP in getting it, the switch,
if we turn on Source Guard, can say,
you know what, buddy, it says to the packet,
I don't recognize you.
I don't think you're legit, and drop it right at the port
so it doesn't come into our network.
This feature is called IPv6 Source Guard,
and now that we know what Source Guard does,
I'd like to go ahead and show you
an example of implementing Source Guard on a switch that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
an example of implementing Source Guard on a switch that
supports it.
So here's the syntax and implementation
for Source Guard.
We create a policy, we're calling it Our SG IPv6 Source
dash Guard Policy, and then with a little bit of help
from probably a PDF from Cisco on configuring
IPv6 first top security, there is a laundry list
of options that you can specify based on your environment, what
you think the risks are, and the features that you
want in this policy.
And then once you've created the policy,
you can then go ahead and apply it.
So here we're going to VLAN configuration 1 IPv6 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here we're going to VLAN configuration 1 IPv6
Source Guard Attach Policy, and the name of the policy.
Now the syntax on your device is going
to be slightly different depending
on what version of IOS that you're running on that device.
So you might need some context sensitive help or the release
notes or the configuration guides for the version
that you're using, and I also took the opportunity
to go ahead and give you an example of applying a Source
Guard policy to a specific port.
So this applies it to the VLAN on the version of software
I'm running on this switch, and this applies it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm running on this switch, and this applies it
to a specific interface.
It's the same syntax just in VLAN configuration
mode versus interface configuration mode.
So let's go ahead and create this.
Then we'll do a show command to verify them.
So now we have several on this box,
several IPv6 first top security protocols at work.
We have snooping.
We can learn dynamically through neighbor discovery information
about Layer 3 Layer 2 bindings.
We also have the option of eavesdropping
on neighbor solicitations and the normal IP process WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on neighbor solicitations and the normal IP process
to build that trusted binding table.
Then we have RA Guard making sure
that clients aren't going to be sending router advertisements,
and also that routers, based on the policy,
are going to be seeing the correct router
advertisements, including the M flag or the O flag
or neither of those based on what the policy says
they have to do.
DHCP Guard is going to prevent unauthorized DHCP servers,
like rogue DHCP servers or malicious individuals, who
are pretending to be DHCP servers,
from getting their messages, their server
related messages into the network.
Source Guard is going to help us with avoiding redirection WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Source Guard is going to help us with avoiding redirection
or misdirection of traffic.
Because if we take a bogus source address or an address
that hasn't been learned yet, and we get a source IP
packet from that address, the switch can kill it, and say,
you know what, I don't think you're
trustable because I haven't learned
about you from any other way.
I'm going to go out and stop you.
Snooping is an important aspect to all of this,
to dynamically build the binding table that can be referred to.
If we want to do manual entries, we can,
but it makes a lot of sense to go ahead
and do snooping to build that.
Then in here, I have a couple more implementations WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then in here, I have a couple more implementations
of DHCP Guard and Source Guard but on specific ports
as opposed to on the entire VLAN.
So thanks for joining me in this discussion of several
of the IPv6 first top security protocols that
are available to us, and I look forward
to seeing you in the next set of videos.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.