Contents

Configuring ND attack defense· 1

About ND attack defense· 1

ND attack defense tasks at a glance· 1

Enabling source MAC consistency check for ND messages· 2

Configuring ND attack detection· 2

About ND attack detection· 2

Restrictions and guidelines· 3

Procedure· 3

Enabling ND attack detection logging· 3

Display and maintenance commands for ND attack detection· 4

Configuring RA guard· 4

About RA guard· 4

Specifying the role of the attached device· 4

Configuring and applying an RA guard policy· 5

Enabling the RA guard logging feature· 6

Display and maintenance commands for RA guard· 6

Example: Configuring RA guard· 6

Configuring IPv6 destination guard· 8

About IPv6 destination guard· 8

Restrictions and guidelines: IPv6 destination guard configuration· 9

Enabling/disabling IPv6 destination guard globally· 9

Enabling/disabling IPv6 destination guard on an interface· 9

Display and maintenance commands for IPv6 destination guard· 9

 

Configuring ND attack defense

About ND attack defense

IPv6 Neighbor Discovery (ND) attack defense is able to identify forged ND messages to prevent ND attacks.

The IPv6 ND protocol does not provide any security mechanisms and is vulnerable to network attacks. As shown in Figure 1, an attacker can send the following forged ICMPv6 messages to perform ND attacks:

·          Forged NS/NA/RS messages with an IPv6 address of a victim host. The gateway and other hosts update the ND entry for the victim with incorrect address information. As a result, all packets intended for the victim are sent to the attacking terminal.

·          Forged RA messages with the IPv6 address of a victim gateway. As a result, all hosts attached to the victim gateway maintain incorrect IPv6 configuration parameters and ND entries.

Figure 1 ND attack diagram

 

ND attack defense tasks at a glance

All ND attack defense tasks are optional.

·          Enabling source MAC consistency check for ND messages

·          Configuring ND attack detection

·          Configuring RA guard

·          Configuring IPv6 destination guard

Enabling source MAC consistency check for ND messages

About source MAC consistency check

The source MAC consistency check feature is typically configured on gateways to prevent ND attacks.

This feature checks the source MAC address and the source link-layer address for consistency for each arriving ND message.

·          If the source MAC address and the source link-layer address are not the same, the device drops the packet.

·          If the addresses are the same, the device continues learning ND entries.

The ND logging feature logs source MAC inconsistency events, and it sends the log messages to the information center. The information center can then output log messages from different source modules to different destinations. For more information about the information center, see Network Management and Monitoring Configuration Guide.

Procedure

1.        Enter system view.

system-view

2.        Enable source MAC consistency check for ND messages.

ipv6 nd mac-check enable

By default, source MAC consistency check is disabled for ND messages.

3.        (Optional.) Enable the ND logging feature.

ipv6 nd check log enable

By default, the ND logging feature is disabled.

As a best practice, disable the ND logging feature to avoid excessive ND logs.

Configuring ND attack detection

About ND attack detection

ND attack detection checks incoming ND messages for user validity to prevent spoofing attacks. It is typically configured on access devices. It supports the following features:

·          User validity check.

·          ND attack detection logging.

ND attack detection defines the following types of interfaces:

·          ND trusted interface—The device directly forwards ND messages or data packets received by ND trusted interfaces. It does not perform user validity check.

·          ND untrusted interface—The device discards RA and redirect messages received by ND untrusted interfaces. For other types of ND messages received by the ND untrusted interfaces, the device checks the user validity.

ND attack detection compares the source IPv6 address and the source MAC address in an incoming ND message against security entries from other modules.

·          If a match is found, the device verifies the user as legal in the receiving VLAN, and it forwards the packet.

·          If no match is found, the device verifies the user as illegal, and it discards the ND message.

ND attack detection uses static IPv6 source guard binding entries and DHCPv6 snooping entries for user validity check.

Static IPv6 source guard binding entries are created by using the ipv6 source binding command. For information about IPv6 source guard, see "Configuring IP source guard." For information about DHCPv6 snooping, see Layer 3–IP Services Configuration Guide.

Restrictions and guidelines

When you configure ND attack detection, follow these restrictions and guidelines:

·          To prevent ND untrusted interfaces from dropping all received ND messages, make sure IPv6 source guard static bindings, DHCPv6 snooping, or both features are configured.

·          To make the IPv6 source guard static bindings effective for ND attack detection, you must perform the following operations:

¡  Specify the vlan vlan-id option in the ipv6 source binding command.

¡  Enable ND attack detection for the same VLAN.

Procedure

1.        Enter system view.

system-view

2.        Enter VLAN view.

vlan vlan-id

3.        Enable ND attack detection.

ipv6 nd detection enable

By default, ND attack detection is disabled.

4.        (Optional.) Configure the interface as ND trusted interface:

a.    Return to system view.

quit

b.    Enter Layer 2 Ethernet or aggregate interface view.

interface interface-type interface-number

c.    Configure the interface as ND trusted interface.

ipv6 nd detection trust

By default, all interfaces are ND untrusted interfaces.

Enabling ND attack detection logging

About ND attack detection logging

This feature allows a device to generate logs when it detects invalid ND packets. The log information helps administrators locate and solve problems. Each log records the following information:

·          Victim port numbers in a VLAN.

·          IDs of the victim Ethernet service instances in a VXLAN.

·          Source IP address of the invalid ND packets.

·          Source MAC address of the invalid ND packets.

·          VLAN ID of the invalid ND packets.

·          Total number of dropped ND packets.

Procedure

1.        Enter system view.

system-view

2.        Enable ND attack detection logging.

ipv6 nd detection log enable

By default, ND attack detection logging is disabled.

Display and maintenance commands for ND attack detection

Execute display commands in any view and reset commands in user view.

 

Task	Command
Display statistics for ND messages dropped by ND attack detection.	display ipv6 nd detection statistics [ interface interface-type interface-number ]
Clear ND attack detection statistics.	reset ipv6 nd detection statistics [ interface interface-type interface-number  ]

 

Configuring RA guard

About RA guard

RA guard allows Layer 2 access devices to analyze and block unwanted and forged RA messages.

Upon receiving an RA message, the device makes the forwarding or dropping decision based on the role of the attached device or the RA guard policy.

1.        If the role of the device attached to the receiving interface is router, the device forwards the RA message. If the role is host, the device drops the RA message.

2.        If no attached device role is set, the device uses the RA guard policy applied to the VLAN of the receiving interface to match the RA message.

¡  If the policy does not contain match criteria, the policy will not take effect and the device forwards the RA message.

¡  If the RA message content matches every criterion in the policy, the device forwards the message. Otherwise, the device drops the message.

Specifying the role of the attached device

Restrictions and guidelines

Make sure your setting is consistent with the type of the attached device. If you are not aware of the device type, do not specify a role for the device.

Procedure

1.        Enter system view.

system-view

2.        Enter interface view.

¡  Enter Layer 2 Ethernet interface view.

interface interface-type interface-number

¡  Enter aggregate interface view.

interface bridge-aggregation interface-number

3.        Specify the role of the device attached to the interface.

ipv6 nd raguard role { host | router }

By default, the role of the device attached to the interface is not specified.

Configuring and applying an RA guard policy

About RA guard policy configuration

Configure an RA guard policy if you do not specify a role for the attached device or if you want to filter the RA messages sent by a router.

Procedure

1.        Enter system view.

system-view

2.        Create an RA guard policy and enter its view.

ipv6 nd raguard policy policy-name

3.        Configure the RA guard policy.

Choose the following tasks as needed:

¡  Specify an ACL match criterion.

if-match acl { ipv6-acl-number | name ipv6-acl-name }

¡  Specify a prefix match criterion.

if-match prefix acl { ipv6-acl-number | name ipv6-acl-name }

¡  Specify a router preference match criterion.

if-match router-preference maximum { high | low | medium }

¡  Specify an M flag match criterion.

if-match autoconfig managed-address-flag { off | on }

¡  Specify an O flag match criterion.

if-match autoconfig other-flag { off | on }

¡  Specify a maximum or minimum hop limit match criterion.

if-match hop-limit { maximum | minimum } limit

By default, the RA guard policy is not configured.

4.        Quit RA guard policy view.

quit

5.        Enter VLAN view.

vlan vlan-number

6.        Apply an RA guard policy to the VLAN.

ipv6 nd raguard apply policy [ policy-name ]

By default, no RA guard policy is applied to the VLAN.

Enabling the RA guard logging feature

About RA guard logging

This feature allows a device to generate logs when it detects forged RA messages. The log information helps administrators locate and solve problems. Each log records the following information:

·          Name of the interface that received the forged RA message.

·          Source IP address of the forged RA message.

·          Number of RA messages dropped on the interface.

The RA guard logging feature sends the log messages to the information center. The information center can then output log messages from different source modules to different destinations. For more information about the information center, see Network Management and Monitoring Configuration Guide.

Procedure

1.        Enter system view.

system-view

2.        Enable the RA guard logging feature.

ipv6 nd raguard log enable

By default, the RA guard logging feature is disabled.

 

Display and maintenance commands for RA guard

Execute display commands in any view.

 

Task	Command
Display the RA guard policy configuration.	display ipv6 nd raguard policy [ policy-name ]
Display RA guard statistics.	display ipv6 nd raguard statistics [ interface interface-type interface-number ]
Clear RA guard statistics.	reset ipv6 nd raguard statistics [ interface interface-type interface-number ]

 

Example: Configuring RA guard

Network configuration

As shown in Figure 2, Twenty-FiveGigE 1/0/1, Twenty-FiveGigE 1/0/2, and Twenty-FiveGigE 1/0/3 of Device B are in VLAN 10.

Configure RA guard on Device B to filter forged and unwanted RA messages.

·          Configure an RA policy in VLAN 10 for Twenty-FiveGigE 1/0/2 to filter all RA messages received from the unknown device.

·          Specify host as the role of the host. All RA messages received on Twenty-FiveGigE 1/0/1 are dropped.

·          Specify router as the role of the Device A. All RA messages received on Twenty-FiveGigE 1/0/3 are forwarded.

Figure 2 Network diagram

‌

Procedure

# Create an RA guard policy named policy1.

<DeviceB> system-view

[DeviceB] ipv6 nd raguard policy policy1

# Set the maximum router preference to high for the RA guard policy.

[DeviceB-raguard-policy-policy1] if-match router-preference maximum high

# Specify on as the M flag match criterion for the RA guard policy.

[DeviceB-raguard-policy-policy1] if-match autoconfig managed-address-flag on

# Specify on as the O flag match criterion for the RA guard policy.

[DeviceB-raguard-policy-policy1] if-match autoconfig other-flag on

# Set the maximum advertised hop limit to 120 for the RA guard policy.

[DeviceB-raguard-policy-policy1] if-match hop-limit maximum 120

# Set the minimum advertised hop limit to 100 for the RA guard policy.

[DeviceB-raguard-policy-policy1] if-match hop-limit minimum 100

[DeviceB-raguard-policy-policy1] quit

# Assign Twenty-FiveGigE 1/0/1 and Twenty-FiveGigE 1/0/2 to VLAN 10.

[DeviceB] interface twenty-fivegige 1/0/1

[DeviceB-Twenty-FiveGigE1/0/1] port link-type access

[DeviceB-Twenty-FiveGigE1/0/1] port access vlan 10

[DeviceB-Twenty-FiveGigE1/0/1] quit

[DeviceB] interface twenty-fivegige 1/0/2

[DeviceB-Twenty-FiveGigE1/0/2] port link-type access

[DeviceB-Twenty-FiveGigE1/0/2] port access vlan 10

[DeviceB-Twenty-FiveGigE1/0/2] quit

# Configure Twenty-FiveGigE 1/0/3 to trunk VLAN 10.

[DeviceB] interface twenty-fivegige 1/0/3

[DeviceB-Twenty-FiveGigE1/0/3] port link-type trunk

[DeviceB-Twenty-FiveGigE1/0/3] port trunk permit vlan 10

[DeviceB-Twenty-FiveGigE1/0/3] quit

# Apply the RA guard policy policy1 to VLAN 10.

[DeviceB] vlan 10

[DeviceB-vlan10] ipv6 nd raguard apply policy policy1

[DeviceB-vlan10] quit

# Specify host as the role of the device attached to Twenty-FiveGigE 1/0/1.

[DeviceB] interface twenty-fivegige 1/0/1

[DeviceB-Twenty-FiveGigE1/0/1] ipv6 nd raguard role host

[DeviceB-Twenty-FiveGigE1/0/1] quit

# Specify router as the role of the device attached to Twenty-FiveGigE 1/0/3.

[DeviceB] interface twenty-fivegige 1/0/3

[DeviceB-Twenty-FiveGigE1/0/3] ipv6 nd raguard role router

[DeviceB-Twenty-FiveGigE1/0/3] quit

Verifying the configuration

# Verify that the device forwards or drops RA messages received on Twenty-FiveGigE 1/0/2 based on the RA guard policy. (Details not shown.)

# Verify that the device drops RA messages received on Twenty-FiveGigE 1/0/1. (Details not shown.)

# Verify that the device forwards RA messages received on Twenty-FiveGigE 1/0/3 to other interfaces in VLAN 10. (Details not shown.)

Configuring IPv6 destination guard

About IPv6 destination guard

IPv6 destination guard ensures that the device resolves IPv6 destination IP addresses only when the IP addresses have matching DHCPv6 relay entries or IP source guard bindings. The feature ensures that users can access only valid and active terminals, and reduces the number of ND entries on the device, improving device performance.

Before sending out a packet to an IPv6 address, the device performs the IPv6 destination guard as follows:

1.        Searches DHCPv6 relay entries for a match based on the destination IPv6 address and packet output interface.

¡  If a match is found, the device initiates ND resolution from the output interface. If the resolution succeeds, the device sends out the packet. If the resolution fails, the device drops the packet.

¡  If no match is found, the device proceeds to the next step.

2.        Searches IP source guard binding table for a match based on the destination IPv6 address and packet output interface.

¡  If a match is found, the device initiates ND resolution from the output interface. If the resolution succeeds, the device sends out the packet. If the resolution fails, the device drops the packet.

¡  If no match is found, the device does not initiate ND resolution and drops the packet.

The device enters stressed mode when the CPU or memory usage exceeds their thresholds or the number of unresolved ND entries exceeds a specific value. If the device continues resolving a large number of IPv6 addresses in stressed mode, the CPU will be overloaded and the device will crash. To reduce the workload of the device, specify the stressed keyword. In this case, IPv6 destination guard is enabled after device enters stressed mode. The device resolves only IPv6 addresses that pass the IPv6 destination guard check.

For more information about DHCPv6 relay entries, see DHCPv6 relay agent configuration in Layer 3—IP Services Configuration Guide. For more information about IP source guard entries, see "Configuring IP source guard."

Restrictions and guidelines: IPv6 destination guard configuration

You can enable IPv6 destination guard globally or on an interface.

For an interface, the interface-specific IPv6 destination guard status configuration has higher priority than the global IPv6 destination guard status.

If IPv6 destination guard is not enabled on an interface, the IPv6 destination guard status on the interface is determined by the global IPv6 destination guard status.

Enabling/disabling IPv6 destination guard globally

1.        Enter system view.

system-view

2.        Enable or disable IPv6 destination guard globally.

¡  Enable IPv6 destination guard globally.

ipv6 destination-guard global enable [ stressed ]

¡  Disable IPv6 destination guard globally.

undo ipv6 destination-guard global enable

By default, IPv6 destination guard is disabled globally.

Enabling/disabling IPv6 destination guard on an interface

1.        Enter system view.

system-view

2.        Enter system view.

interface interface-type interface-number

3.        Enable or disable IPv6 destination guard on an interface.

¡  Enable IPv6 destination guard on an interface.

ipv6 destination-guard enable [ stressed ]

¡  Disable IPv6 destination guard on an interface.

ipv6 destination-guard disable

By default, the interface-specific IPv6 destination guard status is consistent with the global IPv6 destination guard status.

Display and maintenance commands for IPv6 destination guard

Execute display commands in any view.

 

Task	Command
Display IPv6 destination guard status.	display ipv6 destination-guard [ interface interface-type interface-number ]