IPv6 Source Guard

You can use IPv6 Source Guard (IPSGv6) together with IPv6 Neighbor Discovery Inspection (NDI) on untrusted ports.

The RUCKUS implementation of the IPSGv6 technology supports configuration on a port and specific VLAN memberships on a port.

When IPSGv6 is first enabled, only DHCPv6 packets are allowed, while all other IPv6 traffic is blocked. IPSGv6 allows IPv6 traffic when the system learns IPv6 addresses via IPv6 DHCP snooping.

When IPSGv6 is enabled, the IPv6 user ACLs are not allowed to bind on the IPSGv6-enabled port or VLAN. To enable ACLs on the IPSGv6-configured port, you have to use SG ACLv6 and filters. Before binding SG ACLv6, SG ACLv6 should be enabled using sg-aclv6 enable; once enabled, save the configuration and reboot the switch for SG ACLv6 to take effect and be allowed to bind.

When a new IPv6 source binding entry on the port is created or deleted, an access-list with a permit filter for the IPv6 address is added or deleted. By default, if IPSGv6 is enabled without any IPv6 source binding on the port, an ACL that denies all IPv6 traffic is loaded on the port.

In this section:

  1. Configuration Notes and Feature Limitations for IPv6 Source Guard
  2. Enabling IPv6 Source Guard on a Port or Range of Ports
    IPv6 Source Guard (IPSGv6) is disabled by default. You can enable IPSGv6 on DHCPv6 snooping untrusted ports.
  3. Defining Static IPv6 Source Bindings
    You can manually enter valid IPv6 addresses in the binding database.
  4. Enabling IPv6 Source Guard for a VLAN
    You can enable IPv6 Source Guard (IPSGv6) on a switch or a router for a range of ports in a VLAN or for the entire VLAN.
  5. Enabling IPv6 Source Guard for a LAG Port for a VLAN
    You can enable IPv6 Source Guard (IPSGv6) for a LAG port for a VLAN.
  6. Binding IPv6 Source Guard ACLs to Ports
    You can bind IPv6 ACLs meant for IPv6 Source Guard (IPv6SG) ports (SG ACL) to a port. IP Source Guard ACLs can then be configured to allow TCP traffic and all UDP traffic. The following task binds IPv6SG ACL sg-acl1 to port 1/1/2.
  7. Displaying Learned IPv6 Addresses
Parent topic: DHCPv6