Configuring Nd Attack Defense; Overview; Configuration Restrictions And Guidelines; Configuring Source Mac Consistency Check For Nd Messages - HP FlexNetwork 10500 Series Security Configuration Manual

Configuring ND attack defense

Overview

Neighbor Discovery (ND) attack defense is able to identify forged ND messages to prevent ND
attacks.
The IPv6 ND protocol does not provide any security mechanisms and is vulnerable to network
attacks. An attacker can send the following forged ICMPv6 messages to perform ND attacks:
•
Forged NS/NA/RS messages with an IPv6 address of a victim host. The gateway and other
hosts update the ND entry for the victim with incorrect address information. As a result, all
packets intended for the victim are sent to the attacking host.
•
Forged RA messages with the IPv6 address of a victim gateway. As a result, all hosts attached
to the victim gateway maintain incorrect IPv6 configuration parameters and ND entries.
For information about the IPv6 ND protocol, see Layer 3–IP Services Configuration Guide.
Table 22 ND attack defense features at a glance
ND attack defense
feature
Source MAC consistency
check
ND attack detection
RA guard

Configuration restrictions and guidelines

Do not configure ND attack detection or RA guard on the following interfaces or VLANs:
•
Layer 2 Ethernet or aggregate interfaces where QinQ or VLAN mapping is configured.
•
VLANs to which these interfaces belong.
For more information about QinQ or VLAN mapping, see Layer 2–LAN Switching Configuration
guide.
Configuring source MAC consistency check for
ND messages
The source MAC consistency check feature is typically configured on gateways to prevent ND
attacks.
This feature checks the source MAC address and the source link-layer address for consistency for
each arriving ND message.
•
If the source MAC address and the source link-layer address are not the same, the device
drops the packet.
•
If the addresses are the same, the device continues learning ND entries.
Configured on To block
ND messages in which the Ethernet frame header
Gateways and the source link-layer address option of the ND
message contain different source MAC addresses.
ND messages in which the mapping between the
Access devices source IPv6 address and the source MAC address is
invalid.
Layer 2 access RA messages incompliant with the RA guard policy
devices or identified to be sent from hosts.
514