Dynamic Ipv6Sg Using Dhcpv6 Snooping Configuration Example - HP FlexNetwork 10500 Series Security Configuration Manual

Total entries found: 1
IPv6 Address
2001::1
Dynamic IPv6SG using DHCPv6 snooping configuration
example
Network requirements
As shown in
Perform the following tasks:
•
Enable DHCPv6 snooping on the device to make sure the DHCPv6 client obtains an IPv6
address from the authorized DHCPv6 server. To generate a DHCPv6 snooping entry for the
DHCPv6 client, enable recording of client information in DHCPv6 snooping entries.
•
Enable dynamic IPv6SG on GigabitEthernet 1/0/1 to filter incoming packets by using the
IPv6SG bindings generated based on DHCPv6 snooping entries. Only packets from the
DHCPv6 client are allowed to pass.
Figure 123 Network diagram
Configuration procedure
1. Configure DHCPv6 snooping:
# Enable DHCPv6 snooping globally.
<Device> system-view
[Device] ipv6 dhcp snooping enable
# Configure GigabitEthernet 1/0/2 as a trusted interface.
[Device] interface gigabitethernet 1/0/2
[Device-GigabitEthernet1/0/2] ipv6 dhcp snooping trust
[Device-GigabitEthernet1/0/2] quit
2. Enable IPv6SG:
# Enable IPv6SG on GigabitEthernet 1/0/1 and verify the source IP address and MAC address
for dynamic IPv6SG.
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ipv6 verify source ip-address mac-address
# Enable recording of client information in DHCPv6 snooping entries on GigabitEthernet 1/0/1.
[Device-GigabitEthernet1/0/1] ipv6 dhcp snooping binding record
[Device-GigabitEthernet1/0/1] quit
Verifying the configuration
# Verify that a dynamic IPv6SG binding is generated based on a DHCPv6 snooping entry.
[Device] display ipv6 source binding dhcpv6-snooping
Total entries found: 1
IPv6 Address
2001::1
MAC Address
0001-0202-0202 GE1/0/1
Figure 123, the host (the DHCPv6 client) obtains an IP address from the DHCPv6 server.
MAC Address
040a-0000-0001 GE1/0/1
Interface
Interface
427
VLAN Type
N/A Static
VLAN Type
1 DHCPv6 snooping