Consolidated Platform Configuration Guide, Cisco Ios Release 15.2(4)E (Catalyst 2960-X Switches - Cisco Catalyst 2960 series Configuration Manual

Information about First Hop Security in IPv6
• IPv6 Prefix Guard—The IPv6 prefix guard feature works within the IPv6 source guard feature, to enable
the device to deny traffic originated from non-topologically correct addresses. IPv6 prefix guard is often
used when IPv6 prefixes are delegated to devices (for example, home gateways) using DHCP prefix
delegation. The feature discovers ranges of addresses assigned to the link and blocks any traffic sourced
with an address outside this range.
For more information on IPv6 Prefix Guard, see the
Configuration Guide Library on Cisco.com.
• IPv6 Destination Guard—The IPv6 destination guard feature works with IPv6 neighbor discovery to
ensure that the device performs address resolution only for those addresses that are known to be active
on the link. It relies on the address glean functionality to populate all destinations active on the link into
the binding table and then blocks resolutions before they happen when the destination is not found in
the binding table.
Note
For more information about IPv6 Destination Guard, see the
Cisco IOS IPv6 Configuration Guide Library on Cisco.com.
• IPv6 Neighbor Discovery Multicast Suppress—The IPv6 Neighbor Discovery multicast suppress feature
is an IPv6 snooping feature that runs on a switch or a wireless controller and is used to reduce the amount
of control traffic necessary for proper link operations.
• DHCPv6 Relay—Lightweight DHCPv6 Relay Agent—The DHCPv6 Relay—Lightweight DHCPv6
Relay Agent feature allows relay agent information to be inserted by an access node that performs a
link-layer bridging (non-routing) function. Lightweight DHCPv6 Relay Agent (LDRA) functionality
can be implemented in existing access nodes, such as DSL access multiplexers (DSLAMs) and Ethernet
switches, that do not support IPv6 control or routing functions. LDRA is used to insert relay-agent
options in DHCP version 6 (DHCPv6) message exchanges primarily to identify client-facing interfaces.
LDRA functionality can be enabled on an interface and on a VLAN.
For more information about DHCPv6 Relay, See the
Agent
Related Topics
How to Configure an IPv6 Snooping Policy, on page 681
How to Attach an IPv6 Snooping Policy to an Interface, on page 683
How to Attach an IPv6 Snooping Policy to a Layer 2 EtherChannel Interface, on page 684
How to Configure the IPv6 Binding Table Content , on page 685
How to Configure an IPv6 Neighbor Discovery Inspection Policy, on page 687
How to Attach an IPv6 Neighbor Discovery Inspection Policy to an Interface , on page 689
How to Attach an IPv6 Neighbor Discovery Multicast Suppress Policy on a Device, on page 691
How to Attach an IPv6 Neighbor Discovery Multicast Suppress Policy on an Interface, on page 692
How to Attach an IPv6 Neighbor Discovery Multicast Suppress Policy to a Layer 2 EtherChannel Interface,
on page 694
How to Attach an IPv6 Snooping Policy to a Layer 2 EtherChannel Interface, on page 684

Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)

680
IPv6 Destination Guard is recommended only on Layer 3. It is not recommended on
Layer2.
section of the IP Addressing: DHCP Configuration Guide, Cisco IOS Release 15.1SG.
IPv6 Prefix Guard chapter of the Cisco IOS IPv6
IPv6 Destination Guard
DHCPv6 Relay—Lightweight DHCPv6 Relay
chapter of the