IPv6 First Hop Security: RA Guard and DHCPv6 Guard

IPv6 hands hosts a much larger attack surface than IPv4 at the first hop, because autoconfiguration is designed to be plug and play. Any laptop with radvd installed can advertise itself as a router and become the default gateway for an entire VLAN; any device can answer DHCPv6 requests; and stateless address autoconfiguration means a host will use whatever prefix it is told about. First Hop Security is the set of Layer 2 features that put the access switch in control of that process. A complete deployment uses four components together — RA Guard, DHCPv6 Guard, IPv6 snooping and IPv6 source guard — and this article covers how they fit together and how to configure them without breaking legitimate hosts.

The four components and what each stops

RA Guard is the highest-value single feature, because a rogue RA redirects every host's default gateway and can be run by any user with administrator rights on a laptop. DHCPv6 Guard is its counterpart for stateful addressing, validating both the source of the message and, where configured, the advertised prefixes.

Policy model: define once, apply many

Cisco implements these as policies applied to interfaces or VLANs, which keeps configuration consistent across hundreds of access ports.

ipv6 nd raguard policy ROUTER-POLICY
 device-role router
ipv6 nd raguard policy HOST-POLICY
 device-role host

ipv6 dhcp guard policy DHCP-SERVER-POLICY
 device-role server
ipv6 dhcp guard policy DHCP-CLIENT-POLICY
 device-role client

ipv6 snooping policy SNOOP-POLICY
 limit address-count 20

ipv6 source-guard policy SRC-GUARD
 deny global-autoconf

Now apply them where they belong. The uplink toward the real router carries the router policy; every user-facing port carries the host policy.

interface TenGigabitEthernet1/0/1
 description UPLINK-TO-CORE-ROUTER
 ipv6 nd raguard attach-policy ROUTER-POLICY
 ipv6 dhcp guard attach-policy DHCP-SERVER-POLICY

interface range GigabitEthernet1/0/2 - 24
 description ACCESS-PORTS
 ipv6 nd raguard attach-policy HOST-POLICY
 ipv6 dhcp guard attach-policy DHCP-CLIENT-POLICY
 ipv6 snooping attach-policy SNOOP-POLICY
 ipv6 source-guard attach-policy SRC-GUARD

vlan configuration 20
 ipv6 snooping

Getting the direction right is the whole game: attach the router policy to the port that faces the legitimate router, and the host policy to everything else. Reversing them on a single port either blocks the real router or lets a rogue one through, and both outcomes look like "IPv6 is broken" to the user.

Rolling out without an outage

Start in the least disruptive order. Enable IPv6 snooping first so the binding table is populated and stable, then RA Guard on access ports, then DHCPv6 Guard, and finally source guard. Source guard is the most likely to break something, because hosts with statically configured addresses are not in the binding table; if your environment uses static IPv6 addressing, either pre-provision bindings or exclude those ports.

Before enabling anything, take a count of what is currently on the wire — a quick passive capture on a mirror port will show whether unexpected RAs are already present, which is the justification you need for the change.

show ipv6 snooping capture-policy
show ipv6 snooping binding
show ipv6 nd raguard policy
show ipv6 dhcp guard policy
show ipv6 source-guard policy
show ipv6 snooping statistics policy

The statistics counters are the useful ones over time: a nonzero RA-drop counter on an access port block is either a rogue device or a misconfigured port that should have been treated as a router port.

Complementary controls

First Hop Security protects addressing, not access. Pair it with the identity layer — 802.1X or MAB with the right RADIUS design, as described in WPA3 Enterprise and 802.1X RADIUS configuration — and with the AAA platform choice covered in RADIUS versus TACACS+ for Cisco AAA. Where the environment is unmanaged, port-level controls are the only reliable boundary, and logging every drop to the collector referenced in SNMPv3 configuration turns the feature from silent protection into something you can audit.

原文链接：https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9200/software/release/17-9/configuration_guide/sec/b_179_sec_9200_cg/configuring_ipv6_first_hop_security.html