Enabling Source Mac Consistency Check For Nd Packets; Configuring The Nd Detection Function; Introduction To Nd Detection - HP 12500 Series Configuration Manual

The source MAC address in the Ethernet frame header is inconsistent with that carried in the source
•
link layer address option of the ND packet.
The mapping between the source IPv6 address and the source MAC address in the Ethernet frame
•
header is invalid.
According to the features of attacking ND packets, security features such as source MAC consistency
check and ND detection are developed.
Enabling source MAC consistency check for ND
packets
CAUTION:
Disable source MAC consistency check for ND packets if VRRP is used. This is to prevent incorrect packet
dropping, because with VRRP, the source MAC address of an NA message is always different from that in
the source link layer address option.
Source MAC consistency check enables a gateway to filter out an ND packet if its source MAC address
in the Ethernet frame header is different from that carried in the source link layer address option.
To enable source MAC consistency check for ND packets:
Step
1. Enter system view.
2. Enable source MAC consistency check
for ND packets.

Configuring the ND detection function

Introduction to ND detection

The ND detection function is mainly used on access devices to verify sources of ND packets. If an ND
packet comes from a spoofing host or gateway, it is discarded.
The ND detection function is enabled on a per VLAN basis. In an ND detection-enabled VLAN, a port
is assigned the ND-trusted role or ND-untrusted role.
On an ND-trusted port, the ND detection function does not check ND packets for address spoofing.
•
On an ND-untrusted port, RA and RR messages are considered illegal and discarded directly, while
•
all other ND packets in the VLAN are checked for source spoofing.
The ND detection function checks an ND packet by looking up the IPv6 static bindings table of the IP
source guard function, ND snooping table, and DHCPv6 snooping table based on its source IPv6
address and source MAC address in the Ethernet frame header. If all the three tables are available, the
table lookup procedure is as follows:
Look up the IPv6 static bindings table of IP source guard. If a match is found, the ND packet is
•
considered legal and forwarded. If an entry is found matching the source IPv6 address but not the
source MAC address, the ND packet is considered illegal and discarded. If no entry is found for the
Command
system-view
ipv6 nd mac-check enable
283
Remarks
N/A
Disabled by default.