IPv6 Source Guard

You can use IPv6 Source Guard (IPSGv6) together with IPv6 Neighbor Discovery Inspection (NDI) on untrusted ports.

The RUCKUS implementation of the IPSGv6 technology supports configuration on a port and specific VLAN memberships on a port.

When IPSGv6 is first enabled, only DHCPv6 packets are allowed, while all other IPv6 traffic is blocked. IPSGv6 allows IPv6 traffic when the system learns IPv6 addresses via IPv6 DHCP snooping.

When a new IPv6 source entry binding on the port is created or deleted, an access-list with a permit filter for the IPv6 address is added or deleted. By default, if IPSGv6 is enabled without any IPv6 source binding on the port, an ACL that denies all IPv6 traffic is loaded on the port.

In this section:

  1. Configuration Notes and Feature Limitations for IPv6 Source Guard
  2. Enabling IPv6 Source Guard on a Port or Range of Ports
    IPv6 Source Guard (IPSGv6) is disabled by default. You can enable IPSGv6 on DHCPv6 snooping untrusted ports.
  3. Defining Static IPv6 Source Bindings
    You can manually enter valid IPv6 addresses in the binding database.
  4. Enabling IPv6 Source Guard for a VLAN
    You can enable IPv6 Source Guard (IPSGv6) on a switch or a router for a range of ports in a VLAN or on the entire VLAN.
  5. Enabling IPv6 Source Guard for a LAG Port for a VLAN
    You can enable IPv6 Source Guard (IPSGv6) for a LAG port for a VLAN.
  6. Displaying Learned IPv6 Addresses
Parent topic: DHCPv6