DHCPv6 Snooping

In an IPv6 domain, a node can obtain an IPv6 address using the following mechanisms:

  • IPv6 address auto-configuration using router advertisements
  • The DHCPv6 protocol

In a typical man-in-the-middle (MITM) attack, the attacker can snoop or spoof the traffic acting as a rogue DHCPv6 server. To prevent such attacks, DHCPv6 snooping helps to secure the IPv6 address configuration in the network.

DHCPv6 snooping enables the RUCKUS device to filter untrusted DHCPv6 packets in a subnet on an IPv6 network. DHCPv6 snooping can ward off MiM attacks, such as a malicious user posing as a DHCPv6 server sending false DHCPv6 server reply packets with the intention of misdirecting other users. DHCPv6 snooping can also stop unauthorized DHCPv6 servers and prevent errors due to user misconfiguration of DHCPv6 servers.

In this section:

  1. How DHCPv6 Snooping Works
  2. Configuration Notes and Feature Limitations for DHCPv6 Snooping
  3. Configuring DHCPv6 Snooping
    DHCPv6 snooping must be enabled on VLANs, after which the trust setting of ports connected to a DHCPv6 server must be changed to trusted. DHCPv6 packets for a VLAN with DHCPv6 snooping enabled are inspected.
  4. Configuring DHCPv6 Snooping on Multiple VLANs
    DHCPv6 snooping can be enabled on multiple VLANs using one command. The following task configures multiple VLANs and enables DHCPv6 snooping on most of the configured VLANs using a single command.
  5. Configuring DHCPv6 Snooping for Multi-VRF
    DHCPv6 snooping supports Multi-VRF. You can deploy multiple Virtual Routing and Forwarding instances (VRFs) on a RUCKUS Ethernet switch. Each VLAN with a Virtual Ethernet (VE) interface is assigned to a VRF.
  6. Displaying DHCPv6 Snooping Information
    You can use various show commands to view information about DHCPv6 snooping.
Parent topic: DHCPv6