Cisco Catalyst 2960-X Security Configuration Manual page 474

How to Configure an IPv6 Neighbor Discovery Inspection Policy
Command or Action
Step 3
device-role {host | monitor | router | switch}
Example:
Switch(config-nd-inspection)# device-role switch
Step 4 drop-unsecure
Example:
Switch(config-nd-inspection)# drop-unsecure
Step 5 limit address-count value
Example:
Switch(config-nd-inspection)# limit address-count 1000
Step 6 sec-level minimum value
Example:
Switch(config-nd-inspection)# limit address-count 1000
Step 7
tracking {enable [reachable-lifetime {value | infinite}] |
disable [stale-lifetime {value | infinite}]}
Example:
Switch(config-nd-inspection)# tracking disable
stale-lifetime infinite
Step 8
trusted-port
Example:
Switch(config-nd-inspection)# trusted-port
Step 9 validate source-mac
Example:
Switch(config-nd-inspection)# validate source-mac
Step 10 no {device-role | drop-unsecure | limit address-count |
sec-level minimum | tracking | trusted-port | validate
source-mac}
Example:
Switch(config-nd-inspection)# no validate source-mac
Step 11 default {device-role | drop-unsecure | limit address-count |
sec-level minimum | tracking | trusted-port | validate
source-mac}
Example:
Switch(config-nd-inspection)# default limit
address-count
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
450
Configuring IPv6 First Hop Security
Purpose
Specifies the role of the device attached to the port.
The default is host.
Drops messages with no or invalid options or an
invalid signature.
Enter 1–10,000.
Specifies the minimum security level parameter
value when Cryptographically Generated Address
(CGA) options are used.
Overrides the default tracking policy on a port.
Configures a port to become a trusted port.
Checks the source media access control (MAC)
address against the link-layer address.
Remove the current configuration of a parameter
with the no form of the command.
Restores configuration to the default values.
OL-29048-01