Configuring Nd Detection - HP 5120 SI Series Security Configuration Manual

The ND detection function operates on a per VLAN basis. In an ND detection-enabled VLAN, a port is
either ND-trusted or ND-untrusted:
An ND-trusted port does not check ND packets for address spoofing.
•
An ND-untrusted port checks all ND packets but RA and RR messages in the VLAN for source
•
spoofing. RA and RR messages are considered illegal and discarded directly.
The ND detection function checks an ND packet by looking up the IPv6 static bindings table of the IP
source guard function, ND snooping table, and DHCPv6 snooping table in the following steps:
1. Looks up the IPv6 static bindings table of IP source guard, based on the source IPv6 address and
the source MAC address in the Ethernet frame header of the ND packet. If an exact match is found,
the ND packet is forwarded. If an entry matches the source IPv6 address but not the source MAC
address, the ND packet is discarded. If no entry matches the source IPv6 address, the ND
detection function continues to look up the DHCPv6 snooping table and the ND snooping table.
2. If an exact match is found in either the DHCPv6 snooping or ND snooping table, the ND packet is
forwarded. If no match is found in either table, the packet is discarded. If neither the DHCPv6
snooping table nor the ND snooping table is available, the ND packet is discarded.
NOTE:
To create IPv6 static bindings with IP source guard, use the user-bind ipv6 command. For more
•
information, see the chapter
The DHCPv6 snooping table is created automatically by the DHCPv6 snooping module. For more
•
information, see the
The ND snooping table is created automatically by the ND snooping module. For more information, see
•
Layer 3—IP Services Configuration Guide
the

Configuring ND detection

Follow these steps to configure ND detection:
To do...
Enter system view
Enter VLAN view
Enable ND Detection
Quit system view
Enter Layer 2 Ethernet interface view or
Layer 2 aggregate interface view
Configure the port as an ND-trusted
port
"
IP source guard configuration."
Layer 3—IP Services Configuration Guide
Use the command...
system-view
vlan vlan-id
ipv6 nd detection enable
quit
interface interface-type
interface-number
ipv6 nd detection trust
321
.
.
Remarks
––
––
Required
Disabled by default.
––
––
Optional
A port does not trust sources of
ND packets by default.