Dynamic Ipv6 Source Guard Binding By Nd Snooping Configuration Example - HP A5830 Series Configuration Manual

Dynamic IPv6 source guard binding by ND snooping
configuration example
Network requirements
As shown in
Enable ND snooping on the device, establishing ND snooping entries by listening to DAD NS messages.
Enable the IPv6 source guard function on port GigabitEthernet 1/0/1 to filter packets based on the ND
snooping entries, allowing only packets with a legally obtained IPv6 address to pass.
Figure 72 Network diagram for configuring dynamic IPv6 source guard binding by ND snooping
Client
Configuration procedure
Configure ND snooping.
1.
# In VLAN 2, enable ND snooping.
<Device> system-view
[Device] vlan 2
[Device-vlan2] ipv6 nd snooping enable
[Device-vlan2] quit
Configure the IPv6 source guard function.
2.
# Configure the IPv6 source guard function on GigabitEthernet 1/0/1 to filter packets based on both the
source IP address and MAC address.
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ipv6 verify source ipv6-address mac-address
[Device-GigabitEthernet1/0/1] quit
Verification
# Display the IPv6 source guard binding entries generated on port GigabitEthernet 1/0/1.
[Device] display ipv6 source binding
Total entries found: 1
MAC Address
040a-0000-0001
# Display the IPv6 ND snooping entries to see whether they are consistent with the dynamic IP source
guard entries generated on GigabitEthernet 1/0/1.
[Device] display ipv6 nd snooping
IPv6 Address
2001::1
---- Total entries: 1 ----
The output shows that a dynamic IPv6 source guard entry has been generated on port GigabitEthernet
1/0/1 based on the ND snooping entry.
Figure 72, the client is connected to the device through port GigabitEthernet 1/0/1.
VLAN 2
GE1/0/1 GE1/0/2
Device
ND snooping
IP Address
2001::1
IP network
VLAN Interface
2 GE1/0/1
MAC Address VID
040a-0000-0001 2
221
Type
ND-SNP
Interface Aging Status
GE1/0/1 25 Bound