IPv6 First Hop Security

What it is

IPv6 first hop security is a set of switch features that protect hosts from rogue or spoofed IPv6 messages on the local link.

IPv6 hosts trust messages on the local link. Router advertisements (RA) tell a host its prefix and default gateway, and neighbour discovery (ND) maps addresses to MAC addresses. A rogue device can send false versions of these messages.

First hop security (FHS) is applied on the access switch, at the first hop between a host and the network. This topic is about describing what each feature does, not detailed configuration.

How it works

Each feature stops one type of attack, and most depend on a shared binding table.

The attacks

RA guard

RA guard blocks router advertisements that arrive on ports where no router should be. A policy sets the device role of the port, either host or router.

Switch(config)# ipv6 nd raguard policy HOST-PORTS
Switch(config-nd-raguard)# device-role host
Switch(config)# interface GigabitEthernet1/0/5
Switch(config-if)# ipv6 nd raguard attach-policy HOST-PORTS

An RA arriving on a host role port is dropped. Ports that lead to a real router are left as router role, so legitimate RAs pass. The policy can also check things such as the source address and the advertised prefix.

DHCPv6 guard

DHCPv6 guard stops rogue DHCPv6 servers. It blocks server messages, such as Advertise and Reply, on ports where no server should be.

Switch(config)# ipv6 dhcp guard policy CLIENT-PORTS
Switch(config-dhcp-guard)# device-role client
Switch(config)# interface GigabitEthernet1/0/5
Switch(config-if)# ipv6 dhcp guard attach-policy CLIENT-PORTS

Client role ports may send requests but not server replies. A port that faces the real DHCPv6 server uses the server role.

Binding table, ND snooping and ND inspection

The switch watches ND and DHCPv6 messages to learn which addresses sit behind which ports. This is ND snooping (also known as IPv6 snooping or device tracking). It builds the binding table.

A binding table entry links an IPv6 address, a MAC address, a port and a VLAN. Entries age out, and the state shows whether the entry is still valid.

ND inspection then uses the binding table to check ND messages. A neighbour solicitation or advertisement that does not match a known binding is dropped. This stops one host from claiming another host's address.

Switch# show ipv6 neighbor binding
Switch# show device-tracking database

The first command is used on older software. On newer Catalyst software this tracking is part of a feature called SISF, the policy commands are under device-tracking, and the table is shown with the second command. The ideas are the same, and feature names vary by platform and release.

IPv6 source guard

Source guard checks the source address of data packets against the binding table. It drops packets from a port whose source address does not match a binding for that port.

This stops a host from spoofing the source address of other hosts. Source guard depends on a correct binding table, so snooping must be on first.

How the features combine

RA guard and DHCPv6 guard work by port role and message type. Inspection and source guard compare against learned bindings.

A typical access port policy uses all of them. The uplink toward the router and DHCP server is trusted, and host ports are not.