Ipv6 Nd Snooping Auto-Detect - Edge-Core ES3528MV2 Management Manual

| IP Interface Commands
C 45
HAPTER
ND Snooping
ipv6 nd snooping
auto-detect
lifetime, as well as the VLAN and port interface which received the
message.
If an RA message is not received updating a table entry with the
■
same prefix for a specified timeout period, the entry is deleted.
Once ND snooping is enabled both globally and on the required VLANs,
◆
the switch will start monitoring NS messages to build a dynamic user
binding table for use in Duplicate Address Detection (DAD) or for use by
other security filtering protocols (e.g., IPv6 Source Guard) as described
below:
If an NS message is received on an trusted interface, it is forwarded
■
without further processing.
If an NS message is received on an untrusted interface, and the
■
address prefix does not match any entry in the prefix table, it drops
the packet.
If the message does match an entry in the prefix table, it adds an
entry to the dynamic user binding table after a fixed delay, and
forwards the packet. Each entry in the dynamic binding table
includes the link-layer address, IPv6 address, lifetime, as well as
the VLAN and port interface which received the message.
If an RA message is received in response to the original NS
■
message (indicating a duplicate address) before the dynamic
binding timeout period expires, the entry is deleted. Otherwise,
when the timeout expires, the entry is dropped if the auto-detection
process is not enabled.
If the auto-detection process is enabled, the switch periodically
■
sends an NS message to determine is the client still exists. If it does
not receive an RA message in response after the configured
timeout, the entry is dropped. If the switch receives an RA message
before the timeout expires, it resets the lifetime for the dynamic
binding, and the auto-detection process resumes.
E
XAMPLE
This example enables ND snooping globally and on VLAN 1.
Console(config)#ipv6 nd snooping
Console(config)#ipv6 nd snooping vlan 1
Console(config)#
This command enables automatic validation of dynamic user binding table
entries by periodically sending NS messages and awaiting NA replies. Use
the no form to disable this feature.
S
YNTAX
[no] ipv6 nd snooping auto-detect
– 1432 –