ND attack defense configuration commands 1

Source MAC consistency check commands 1

ipv6 nd mac-check enable· 1

ND detection configuration commands 1

display ipv6 nd detection· 2

display ipv6 nd detection statistics 2

ipv6 nd detection enable· 3

ipv6 nd detection trust 4

reset ipv6 nd detection statistics 4

 

Source MAC consistency check commands

ipv6 nd mac-check enable

Syntax

ipv6 nd mac-check enable

undo ipv6 nd mac-check enable

View

System view

Default level

2: System level

Parameters

None

Description

Use ipv6 nd mac-check enable to enable source MAC consistency check for ND packets.

Use undo ipv6 nd mac-check enable to disable source MAC consistency check for ND packets.

By default, source MAC consistency check for ND packets is disabled.

In a typical forged ND packet, the source MAC address in the Ethernet frame header and that carried in the source link layer address option are different. To filter out these illegal ND packets, you can use the source MAC consistency check function to check ND packets for MAC address inconsistency.

Disable source MAC consistency check for ND packets if VRRP is used. This is to prevent incorrect packet dropping, because with VRRP, the source MAC address of an NA message is always different from that in the source link layer address option.

Examples

# Enable source MAC consistency check for ND packets.

<Sysname> system-view

[Sysname] ipv6 nd mac-check enable

ND detection configuration commands

The switch supports ND detection only when you configure the acl ipv6 enable command. For more information about this command, see ACL and QoS Command Reference.

display ipv6 nd detection

Syntax

display ipv6 nd detection [ | { begin | exclude | include } regular-expression ]

View

Any view

Default level

1: Monitor level

Parameters

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Description

Use display ipv6 nd detection to display ND detection configuration.

Related commands: ipv6 nd detection enable and ipv6 nd detection trust.

Examples

# Display ND detection configuration.

<Sysname> display ipv6 nd detection

ND detection is enabled on the following VLANs:

 1, 2, 4-5

ND detection trust is configured on the following interfaces:

 GigabitEthernet3/0/1

 GigabitEthernet3/0/2

Table 1 Command output

Field	Description
ND detection trust is configured on the following interfaces	List of ND-trusted ports. On an ND-trusted port, ND packets are not checked. By default, all ports are ND-untrusted ports on which ND packets in an ND detection-enabled VLAN will be checked.

 

display ipv6 nd detection statistics

Syntax

display ipv6 nd detection statistics [ interface interface-type interface-number ] [ | { begin | exclude | include } regular-expression ]

View

Any view

Default level

1: Monitor level

Parameters

interface interface-type interface-number: Displays ND detection statistics for the interface identified by interface-type interface-number. The interface-type interface-number arguments represent the interface type and number.

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Description

Use display ipv6 nd detection statistics to display ND detection statistics. At present, the statistics cover only discarded ND packets.

If you specify an interface, this command displays only the statistic for the interface. If you do not specify any interface, this command displays the statistics for all interfaces.

Examples

# Display the statistics for discarded ND packets on all interfaces.

<Sysname> display ipv6 nd detection statistics

ND packets dropped by ND detection:

Interface         Packets Dropped

GE3/0/1             78

GE3/0/2             0

GE3/0/3             0

GE3/0/4             0

ipv6 nd detection enable

Syntax

ipv6 nd detection enable

undo ipv6 nd detection enable

View

VLAN view

Default level

2: System level

Parameters

None

Description

Use ipv6 nd detection enable to enable ND detection in a VLAN to check ND packets for source spoofing.

Use undo ipv6 nd detection enable to disable ND detection.

By default, ND detection is disabled.

Examples

# Enable ND detection in VLAN 3.

<Sysname> system-view

[Sysname] vlan 3

[Sysname-vlan3] ipv6 nd detection enable

ipv6 nd detection trust

Syntax

ipv6 nd detection trust

undo ipv6 nd detection trust

View

Layer 2 Ethernet interface view, Layer 2 aggregate interface view

Default level

2: System level

Parameters

None

Description

Use ipv6 nd detection trust to configure a port as an ND-trusted port.

Use undo ipv6 nd detection trust to configure a port as an ND-untrusted port.

By default, a port is ND-untrusted. In an ND detection-enabled VLAN, ports are assigned two roles: ND-trusted and ND-untrusted.

On an ND-trusted port, the ND detection function does not check ND packets for address spoofing.

On an ND-untrusted port, RA and RR messages are considered illegal and discarded directly. All other ND packets in the VLAN are checked for source spoofing.

Examples

# Configure Layer 2 interface GigabitEthernet 3/0/1 as an ND-trusted port.

<Sysname> system-view

[Sysname] interface gigabitethernet 3/0/1

[Sysname-GigabitEthernet3/0/1] ipv6 nd detection trust

# Configure interface Bridge-Aggregation 1 as an ND-trusted port.

<Sysname> system-view

[Sysname] interface bridge-Aggregation 1

[Sysname-Bridge-Aggregation1] ipv6 nd detection trust

reset ipv6 nd detection statistics

Syntax

reset ipv6 nd detection statistics [ interface interface-type interface-number ]

View

User view

Default level

1: Monitor level

Parameters

interface interface-type interface-number: Clears the statistics of the interface identified by interface-type interface-number. The interface-type interface-number arguments represent the interface type and number.

Description

Use reset ipv6 nd detection statistics to clear the ND detection statistics of an interface. If you do not specify any interface, this command clears the ND detection statistics of all interfaces.

Examples

# Clear the ND detection statistics of all interfaces.

<Sysname> reset ipv6 nd detection statistics