Dell EMC SmartFabric OS10 User Guide Release 10.5.2

Configure IPv6 RA guard

This section describes how to configure IPv6 RA guard.

1. Enable IPv6 RA guard.

   OS10(config)# ipv6 nd ra-guard enable

2. Create an IPv6 RA guard policy.

   OS10(config)# ipv6 nd ra-guard policy ra-guard-test-policy

3. Configure the device role to apply the IPv6 RA guard policy to an interface.

   OS10(conf-ra_guard_policy_list)# device-role router

4. If this command is set to off, the system verifies the advertised managed configuration parameter is set to off in the RA packet and the other way round.
   If this flag is set to off, OS10 skips the validation process.

   OS10(conf-ra_guard_policy_list)# managed-config-flag on

5. (Optional) Create an IPv6 prefix, access, or MAC list. This list specifies the condition that is validated against the RA guard packet that is received. You can optionally use an existing IPv6 prefix, access, or MAC list.

   OS10(config)# ipv6 prefix-list example_prefix_list deny 10::/64 

   OS10(config)# ipv6 access-list example-access-list
   OS10(config-ipv6-acl)# permit udp any any capture session 1
   OS10(config-ipv6-acl)# exit

   OS10(config)# mac access-list example-maclist
   OS10(config-mac-acl)# permit 00:00:00:00:11:11 00:00:11:11:11:11 any vlan 1
   OS10(config-mac-acl)# permit 00:00:00:00:11:11 00:00:11:11:11:11 any cos 7
   OS10(config-mac-acl)# exit

6. The system permits or denies the RA guard packets based on the results of the validation. Specify the prefix, access, or MAC list against which the RA guard packet is validated.

   OS10(conf-ra_guard_policy_list)# match ra ipv6-prefix-list example_prefix_list
   OS10(conf-ra_guard_policy_list)# exit

   OS10(conf-ra_guard_policy_list)# match ra ipv6-access-list example-access-list
   OS10(conf-ra_guard_policy_list)# exit

   OS10(conf-ra_guard_policy_list)# match ra mac-access-list example-maclist

7. Specify the maximum transmission unit (MTU) against which the RA packet is validated.

   OS10(conf-ra_guard_policy_list)# mtu 1280

8. If this command is set to off, the system verifies the advertised other configuration parameter is set to off in the RA packet and the other way round.

   OS10(conf-ra_guard_policy_list)# other-config-flag on

9. Configure the reachability timer value.

   OS10(conf-ra_guard_policy_list)# reachable-time 100

10. Configure the retransmission timer value.

    OS10(conf-ra_guard_policy_list)# retrans-timer 100

11. Configure the router preference.

    OS10(conf-ra_guard_policy_list)# router-preference maximum high

12. Configure the lifetime of the router.

    OS10(conf-ra_guard_policy_list)# router-lifetime 100

13. Apply the policy to an interface.

    OS10(config)# interface ethernet 1/1/6
    OS10(conf-if-eth1/1/6)# ipv6 nd ra-guard attach-policy ra-guard-test-policy vlan 1

    OS10# show ipv6 nd ra-guard ra-guard-test-policy
    ipv6 nd ra-guard policy ra-guard-test-policy
    device-role router
    managed-config true
    other-config true
    mtu 1280
    reachable time 100
    retransmit-timer 100
    router-life-time 100
    router-preference maximum high
    match ra ipv6-prefix-list example_prefix_list
    Interfaces              Vlans
    ----------------------------------
    ethernet1/1/6           vlan1