Configure RA Guard

보통레벨 1수동 검토cisco-nxos

설명

The IPv6 RA Guard feature provides support for allowing the network administrator to block or reject unwanted or rogue RA guard messages that arrive at the network device platform. RAs are used by devices to announce themselves on the link. The IPv6 RA Guard feature analyzes these RAs and filters out RAs that are sent by unauthorized devices. Packets are classified into one of three DHCP type messages. If a packet arriving from DHCP server is a Relay Forward or a Relay Reply, only the device role is checked. CIS assessment: Manual. Reported as SKIP with review instructions.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

CIS assessment: Manual. Use the command "sho ipv6 nd raguard policy" to audit for this configuration. Ensure that a valid RA Guard Policy is applied to all routed VLANs, unless this causes some operational issue. switch# sho ipv6 nd raguard policy Policy RAGuardPol01 configuration: trusted-port device-role router hop-limit minimum 3 managed-config-flag on other-config-flag on router-preference maximum high Policy RAGuardPol01 is applied on the following targets: Target Type Policy Feature Target range vlan 10 VLAN RAGuardPol01 RA guard vlan all Notes: The ...

조치 방법

조치 방식: 가이드 또는 인프라 패치

! In the example below, the RA Guard policy is created, then applied to a VLAN. Example ipv6 nd raguard policy RAGuardPol01 device-role router hop-limit minimum 3 managed-config-flag on other-config-flag on router-preference maximum high trusted-port Configuring RA Guard on an interface Example vlan configuration 10 switch(config-if) ipv6 nd raguard attach-policy RAGuardPol01

속성

운영 체제: 모두
태그: cisco-nxosnetworkhardening
참고 자료: CIS Cisco NX-OS Benchmark v1.2.0 - 3.2.1.1 Configure RA Guard