Contents

ND attack defense commands· 1

Source MAC consistency check commands· 1

ipv6 nd check log enable· 1

ipv6 nd mac-check enable· 1

ND attack detection commands· 2

display ipv6 nd detection statistics· 2

ipv6 nd detection enable· 3

ipv6 nd detection log enable· 3

ipv6 nd detection trust 4

reset ipv6 nd detection statistics· 4

ND scanning commands· 5

ipv6 nd scan auto enable· 5

ipv6 nd scan auto send-rate· 6

 

ND attack defense commands

Source MAC consistency check commands

ipv6 nd check log enable

Use ipv6 nd check log enable to enable the ND logging feature.

Use undo ipv6 nd check log enable to restore the default.

Syntax

ipv6 nd check log enable

undo ipv6 nd check log enable

Default

The ND logging feature is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

The ND logging feature logs source MAC inconsistency events, and sends the log messages to the information center. The information center can then output log messages from different source modules to different destinations. For more information about the information center, see System Management Configuration Guide.

As a best practice, disable the ND logging feature to avoid excessive ND logs.

Examples

# Enable the ND logging feature.

<Sysname> system-view

[Sysname] ipv6 nd check log enable

Related commands

ipv6 nd mac-check enable

ipv6 nd mac-check enable

Use ipv6 nd mac-check enable to enable source MAC consistency check for ND messages.

Use undo ipv6 nd mac-check enable to disable source MAC consistency check for ND messages.

Syntax

ipv6 nd mac-check enable

undo ipv6 nd mac-check enable

Default

Source MAC consistency check for ND messages is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Use this command to enable source MAC consistency check on a gateway. The gateway checks the source MAC address and the source link-layer address for consistency for each ND message. If an inconsistency is found, the gateway drops the ND message.

Examples

# Enable source MAC consistency check for ND messages.

<Sysname> system-view

[Sysname] ipv6 nd mac-check enable

ND attack detection commands

display ipv6 nd detection statistics

Use display ipv6 nd detection statistics to display statistics for ND messages dropped by ND attack detection.

Syntax

display ipv6 nd detection statistics [ interface interface-type interface-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

interface interface-type interface-number: Specifies an interface by its type and number. If you do not specify an interface, this command displays statistics for ND messages dropped by ND attack detection on all interfaces.

Examples

# Display statistics for all ND messages dropped by ND attack detection.

<Sysname> display ipv6 nd detection statistics

ND packets dropped by ND detection:

Interface/AC           Packets dropped

WGE1/0/1              78

WGE1/0/2              0

WGE1/0/3              0

WGE1/0/4              0

Table 1 Command output

Field	Description
Interface	Input interface of the ND messages.
Packets dropped	Number of ND messages dropped by ND attack detection.

 

ipv6 nd detection enable

Use ipv6 nd detection enable to enable ND attack detection. This feature checks the ND message validity.

Use undo ipv6 nd detection enable to disable ND attack detection.

Syntax

ipv6 nd detection enable

undo ipv6 nd detection enable

Default

ND attack detection is disabled.

Views

VLAN view

Predefined user roles

network-admin

Examples

# Enable ND attack detection for VLAN 10.

<Sysname> system-view

[Sysname] vlan 10

[Sysname-vlan10] ipv6 nd detection enable

ipv6 nd detection log enable

Use ipv6 nd detection log enable to enable ND attack detection logging.

Use undo ipv6 nd detection log enable to disable ND attack detection logging.

Syntax

ipv6 nd detection log enable

undo ipv6 nd detection log enable

Default

ND attack detection logging is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

This command allows a device to generate logs when it detects ND attacks. The log information helps administrators locate and solve problems. The ND attack detection logging feature sends the log message to the information center. The information center can then output log messages from different source modules to different destinations. For more information about information center, see System Management Configuration Guide.

The device performance is degraded when the device outputs a large number of ND attack detection logs. You can disable ND attack detection logging to ensure the device performance.

Examples

# Enable ND attack detection logging.

<Sysname> system-view

[Sysname] ipv6 nd detection log enable

ipv6 nd detection trust

Use ipv6 nd detection trust to configure an interface as an ND trusted interface.

Use undo ipv6 nd detection trust to restore the default.

Syntax

ipv6 nd detection trust

undo ipv6 nd detection trust

Default

All interfaces are ND untrusted interfaces.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

Examples

# Configure Twenty-FiveGigE 1/0/1 as an ND trusted interface.

<Sysname> system-view

[Sysname] interface twenty-fivegige 1/0/1

[Sysname-Twenty-FiveGigE1/0/1] ipv6 nd detection trust

# Configure Bridge-Aggregation 1 as an ND trusted interface.

<Sysname> system-view

[Sysname] interface bridge-aggregation 1

[Sysname-Bridge-Aggregation1] ipv6 nd detection trust

reset ipv6 nd detection statistics

Use reset ipv6 nd detection statistics to clear ND attack detection statistics.

Syntax

reset ipv6 nd detection statistics [ interface interface-type interface-number ]

Views

User view

Predefined user roles

network-admin

Parameters

interface interface-type interface-number: Specifies an interface by its type and number. If you do not specify an interface, this command clears ND attack detection statistics for all interfaces.

Examples

# Clear all ND attack detection statistics.

<Sysname> reset ipv6 nd detection statistics

ND scanning commands

ipv6 nd scan auto enable

Use ipv6 nd scan auto enable to enable automatic ND scanning in a specified address range on an interface.

Use undo ipv6 nd scan auto enable to disable automatic ND scanning on an interface.

Syntax

ipv6 nd scan auto enable start-ipv6-address to end-ipv6-address [ source-addr source-ipv6-address ]

undo ipv6 nd scan auto enable

Default

Automatic ND scanning is disabled on an interface.

Views

Layer 3 Ethernet interface view

Layer 3 aggregate interface view

VLAN interface view

Predefined user roles

network-admin

Parameters

start-ipv6-address: Specifies the start IPv6 address of the scanning range.

to end-ipv6-address: Specifies the end IPv6 address of the scanning range. The end IPv6 address must be higher than or equal to the start IPv6 address. The maximum number of IPv6 addresses in the range is 65535.

source-addr source-ipv6-address: Specifies the source address for the NS requests. The source-ipv6-address argument can be any valid IPv6 addresses. If you do not specify this option, the interface uses its IPv6 address as the source address.

Usage guidelines

The device automatically creates ND entries by NS and NA messages when triggered by traffic. If no traffic is received or sent in a period of time, the ND entries cannot be created or updated in time.

To resolve this issue, you can enable the automatic ND scanning feature on the device. This feature enables the device to periodically send ND packets (NS requests) at a specified rate to the IPv6 addresses not in the specified ND entries.

You can specify the source address for the sending NS requests when you enable automatic ND scanning on an interface:

·     If you do not specify the source address, the interface uses its IPv6 address as the source address. The interface scans the IPv6 addresses that belong to both the automatic ND scanning range and the subnet of the interface IPv6 address.

If the interface is configured with multiple subnet IPv6 addresses and the addresses are also in the scanning range, the source address is the IPv6 address with the longest prefix. If the prefixes are in the same length, the source address is the primary IPv6 address for the interface.

·     If you specify the source address, the interface uses the specified source address, and it scans all the IPv6 addresses in the automatic ND scanning range.

If the interface is enabled with ND proxy, the specified source address does not affect the Layer 3 forwarding route. For more information about ND proxy, see IPv6 basics in Layer 3—IP Services Configuration Guide.

You can set the ARP packet sending rate by using the ipv6 nd scan auto send-rate command.

To avoid any impact on device performance, use automatic ND scanning only on networks where users come online and go offline frequently.

Examples

# Configure the device to scan neighbors in an address range.

<Sysname> system-view

[Sysname] interface twenty-fivegige 1/0/1

[Sysname-Twenty-FiveGigE1/0/1] ipv6 nd scan auto enable 2001::1 to 2001::10

# Configure the device to scan neighbors in an address range.

<Sysname> system-view

[Sysname] interface vlan-interface 100

[Sysname-Vlan-interface100] ipv6 nd scan auto enable 2001::1 to 2001::10

ipv6 nd scan auto send-rate

Use ipv6 nd scan auto send-rate to set the ND packet sending rate for automatic ND scanning.

Use undo ipv6 nd scan auto send-rate to restore the default.

Syntax

ipv6 nd scan auto send-rate { ppm ppm | pps }

undo ipv6 nd scan auto send-rate

Default

The device sends ND packets at the rate of 48 pps during automatic ND scanning.

Views

System view

Predefined user roles

network-admin

Parameters

ppm ppm: Specifies the ND packet sending rate, in packets per minute (ppm). The value range for the ppm argument is 10 to 600, and the value must be a multiple of 10. Alternatively, a configuration error will occur.

ppm pps: Specifies the ND packet sending rate, in packets per second (pps). The value range for the pps argument is 10 to 1000, and the value must be a multiple of 10. Alternatively, a configuration error will occur.

Usage guidelines

This command enables the device to periodically send ND packets (NS requests) at a specified rate. You can adjust the ND packet sending rate to avoid impact on device performance.

To avoid any impact on device performance, the actual ND packet sending rate might be smaller than the configured rate.

Examples

# Set the ND packet sending rate to 10 pps during automatic ND scanning.

<Sysname> system-view

[Sysname] ipv6 nd scan auto send-rate 10

Related commands

ipv6 nd scan auto enable