Cisco Catalyst 2960-XR Security Configuration Manual page 381

Configuring IPv6 First Hop Security
Command or Action
Step 3
device-role {host | monitor | router | switch}
Example:
Switch(config-nd-inspection)# device-role switch
Step 4 drop-unsecure
Example:
Switch(config-nd-inspection)# drop-unsecure
Step 5 limit address-count value
Example:
Switch(config-nd-inspection)# limit address-count 1000
Step 6 sec-level minimum value
Example:
Switch(config-nd-inspection)# limit address-count 1000
Step 7
tracking {enable [reachable-lifetime {value | infinite}] | disable
[stale-lifetime {value | infinite}]}
Example:
Switch(config-nd-inspection)# tracking disable
stale-lifetime infinite
Step 8
trusted-port
Example:
Switch(config-nd-inspection)# trusted-port
Step 9 validate source-mac
Example:
Switch(config-nd-inspection)# validate source-mac
Step 10 no {device-role | drop-unsecure | limit address-count | sec-level
minimum | tracking | trusted-port | validate source-mac}
Example:
Switch(config-nd-inspection)# no validate source-mac
Step 11 default {device-role | drop-unsecure | limit address-count |
sec-level minimum | tracking | trusted-port | validate
source-mac}
Example:
Switch(config-nd-inspection)# default limit
address-count
OL-29434-01
How to Configure an IPv6 Neighbor Discovery Inspection Policy
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
Purpose
Specifies the role of the device attached to the
port. The default is host.
Drops messages with no or invalid options or an
invalid signature.
Enter 1–10,000.
Specifies the minimum security level parameter
value when Cryptographically Generated Address
(CGA) options are used.
Overrides the default tracking policy on a port.
Configures a port to become a trusted port.
Remove the current configuration of a parameter
with the no form of the command.
Restores configuration to the default values.
359