Nd Attack Defense Configuration; Introduction To Nd Attack Defense - HP 5120 SI Series Security Configuration Manual

ND attack defense configuration

This chapter includes these sections:

Introduction to ND attack defense

•
Enabling source MAC consistency check for ND packets
•
Configuring the ND detection function
•
• ND detection configuration example
Introduction to ND attack defense
The IPv6 Neighbor Discovery (ND) protocol provides rich functions, such as address resolution, neighbor
reachability
autoconfiguration, and redirection. However, it does not provide any security mechanisms. Attackers can
easily exploit the ND protocol to attack hosts and gateways by sending forged packets.
The ND protocol implements its function by using the following types of ICMPv6 messages:
Neighbor Solicitation (NS)
•
Neighbor Advertisement (NA)
•
Router Solicitation (RS)
•
• Router Advertisement (RA)
Redirect (RR)
•
An attacker can attack a network by sending forged ICMPv6 messages, as shown in
Sends forged NS/NA/RS packets with the IPv6 address of a victim host. The gateway and other
•
hosts update the ND entry for the victim host with incorrect address information. As a result, all
packets intended for the victim host are sent to the attacking host rather than the victim host.
Sends forged RA packets with the IPv6 address of a victim gateway. As a result, all hosts attached
•
to the victim gateway maintain incorrect IPv6 configuration parameters and ND entries.
detection, duplicate address detection,
319
router/prefix discovery and address
Figure 1 16: