Contents

Configuring ND attack defense· 1

About ND attack defense· 1

Restrictions: Hardware compatibility with ND attack defense· 1

Configuring source MAC-based ND attack detection· 2

About source MAC-based ND attack detection· 2

Restrictions and guidelines· 3

Procedure· 3

Display and maintenance commands for source MAC-based ND attack detection· 3

Configuring interface-based ND attack suppression· 4

Display and maintenance commands for interface-based ND attack suppression· 5

Enabling source MAC consistency check for ND messages· 5

 

Configuring ND attack defense

About ND attack defense

IPv6 Neighbor Discovery (ND) attack defense is able to identify forged ND messages to prevent ND attacks.

The IPv6 ND protocol does not provide any security mechanisms and is vulnerable to network attacks. As shown in Figure 1, an attacker can send the following forged ICMPv6 messages to perform ND attacks:

·     Forged NS/NA/RS messages with an IPv6 address of a victim host. The gateway and other hosts update the ND entry for the victim with incorrect address information. As a result, all packets intended for the victim are sent to the attacking terminal.

·     Forged RA messages with the IPv6 address of a victim gateway. As a result, all hosts attached to the victim gateway maintain incorrect IPv6 configuration parameters and ND entries.

Figure 1 ND attack diagram

 

Restrictions: Hardware compatibility with ND attack defense

Hardware platform	Module type	ND attack defense compatibility
M9006 M9010 M9014	Blade IV firewall module	Yes
	Blade V firewall module	Yes
	NAT module	Yes
	Application delivery engine (ADE) module	Yes
	Anomaly flow cleaner (AFC) module	No
M9010-GM	Encryption module	Yes
M9016-V	Blade V firewall module	Yes
M9008-S M9012-S	Blade IV firewall module	Yes
	Application delivery engine (ADE) module	Yes
	Intrusion prevention service (IPS) module	Yes
	Video network gateway module	Yes
	Anomaly flow cleaner (AFC) module	No
M9008-S-6GW	IPv6 module	Yes
M9008-S-V	Blade IV firewall module	Yes
M9000-AI-E8	Blade V firewall module	Yes
M9000-AI-E16	Application delivery engine (ADE) module	Yes
M9000-AI-E16	Blade V firewall module	Yes

‌

Configuring source MAC-based ND attack detection

About source MAC-based ND attack detection

Source MAC-based ND attack detection checks the number of ND messages delivered to the CPU. If the number of messages from the same MAC address within the check interval exceeds the threshold, the device generates an ND attack entry for the MAC address. The processing of the ND messages sent from the MAC address in this entry depends on the detection mode. With ND logging enabled (by using the ipv6 nd check log enable command), source MAC-based ND attack detection processes the messages as follows:

·     Filter mode—Filters out subsequent ND messages sent from the MAC address, and generates log messages.

·     Monitor mode—Only generates log messages.

During the ND attack defense period, the device monitors the number of dropped packets in an entry within the aging time:

·     If the number of dropped packets is higher than or equal to a calculated value, the device resets the aging time for the entry when the entry ages out.

The calculated value = (aging time/check interval) × source MAC-based ND attack detection threshold

·     If the number of dropped packets is lower than calculated value, the system deletes the entry when the entry ages out and marks MAC address in the entry as a common MAC address.

Restrictions and guidelines

When you change the detection mode from monitor to filter, the filter mode takes effect immediately. When you change the detection mode from filter to monitor, the device continues filtering messages that match existing attack entries.

You can exclude certain MAC addresses from source MAC-based ND attack detection on gateways and servers that might receive large numbers of ND messages. Source MAC-based ND attack detection does not drop ND messages sent from the excluded MAC addresses even if it detects attacks launched from these MAC addresses.

If attacks occur frequently in your network, set a short check interval so that source MAC-based ND attacks can be detected in a timely manner. If attacks seldom occur, you can set a long check interval.

Procedure

1.     Enter system view.

system-view

2.     Enable source MAC-based ND attack detection and set the detection mode.

ipv6 nd source-mac { filter | monitor }

By default, source MAC-based ND attack detection is disabled.

3.     (Optional.) Set the threshold for source MAC-based ND attack detection.

ipv6 nd source-mac threshold threshold-value

The default setting is 30.

4.     (Optional.) Enable the ND logging feature.

ipv6 nd check log enable

By default, the ND logging feature is disabled.

 

Display and maintenance commands for source MAC-based ND attack detection

Execute display commands in any view and reset commands in user view.

 

Task	Command
Display source MAC-based ND attack detection entries.	In standalone mode: display ipv6 nd source-mac interface interface-type interface-number [ slot slot-number [ cpu cpu-number ] ] [ verbose ] display ipv6 nd source-mac { mac mac-address | vlan vlan-id } slot slot-number [ cpu cpu-number ] [ verbose ] display ipv6 nd source-mac slot slot-number [ cpu cpu-number ] [ count | verbose ] In IRF mode: display ipv6 nd source-mac interface interface-type interface-number [ chassis chassis-number slot slot-number [ cpu cpu-number ] ] [ verbose ] display ipv6 nd source-mac { mac mac-address | vlan vlan-id } chassis chassis-number slot slot-number [ cpu cpu-number ] [ verbose ] display ipv6 nd source-mac chassis chassis-number slot slot-number [ cpu cpu-number ] [ count | verbose ]
Delete source MAC-based ND attack detection entries.	In standalone mode: reset ipv6 nd source-mac [ interface interface-type interface-number | mac mac-address | vlan vlan-id ] [ slot slot-number [ cpu cpu-number ] ] In IRF mode: reset ipv6 nd source-mac [ interface interface-type interface-number | mac mac-address | vlan vlan-id ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

‌

Configuring interface-based ND attack suppression

About this task

Use this feature to rate limit ND request on each Layer 3 interface to prevent ND spoofing attacks. This feature monitors the number of ND requests that each Layer 3 interface received within the check interval. If the number on an interface exceeds the threshold, the device creates an ND attack suppression entry for the interface.

During the suppression period, the maximum receiving rate for ND requests is 12800 bytes per second on the interface.

When the suppression time expires, the system examines the number of received ND messages on the interface within the suppression time:

·     If the number of the received ND messages is higher than or equal to a calculated value, the device resets the suppression time for the entry and continues the ND suppression on the interface.

The calculated value = (suppression time/check interval) × suppression threshold

·     If the number of the received ND messages is lower than the calculated value, the device deletes the suppression entry.

Restrictions and guidelines

As a best practice, enable this feature on the gateway.

Procedure

1.     Enter system view.

system-view

2.     Enable interface-based ND attack suppression.

ipv6 nd attack-suppression enable per-interface

By default, interface-based ND attack suppression is disabled.

3.     Set the threshold for triggering ND attack suppression.

ipv6 nd attack-suppression threshold threshold-value

By default, the threshold for triggering ND attack suppression is 1000.

 

Display and maintenance commands for interface-based ND attack suppression

Execute display commands in any view.

 

Task	Command
Display interface-based ND attack suppression entries on an interface.	In standalone mode: display ipv6 nd attack-suppression per-interface interface interface-type interface-number [ slot slot-number [ cpu cpu-number ] ] [ verbose ] In IRF mode: display ipv6 nd attack-suppression per-interface interface interface-type interface-number [ chassis chassis-number slot slot-number [ cpu cpu-number ] ] [ verbose ]
Delete interface-based ND attack suppression entries.	In standalone mode: reset ipv6 nd attack-suppression per-interface [ interface interface-type interface-number ] [ slot slot-number [ cpu cpu-number ] ] In IRF mode: reset ipv6 nd attack-suppression per-interface [ interface interface-type interface-number ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

‌

Enabling source MAC consistency check for ND messages

About this task

The source MAC consistency check feature is typically configured on gateways to prevent ND attacks.

This feature checks the source MAC address and the source link-layer address for consistency for each arriving ND message.

·     If the source MAC address and the source link-layer address are not the same, the device drops the packet.

·     If the addresses are the same, the device continues learning ND entries.

The ND logging feature logs source MAC inconsistency events, and it sends the log messages to the information center. The information center can then output log messages from different source modules to different destinations. For more information about the information center, see Network Management and Monitoring Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Enable source MAC consistency check for ND messages.

ipv6 nd mac-check enable

By default, source MAC consistency check is disabled for ND messages.

3.     (Optional.) Enable the ND logging feature.

ipv6 nd check log enable

By default, the ND logging feature is disabled.

As a best practice, disable the ND logging feature to avoid excessive ND logs.