- [Instructor] We're now into a section
of the Cisco blueprint found
under the infrastructure security section,
where we're told that we need to be able to describe
several IP version six first hop security features.
You don't need to know how to configure these features
for the exam.
You just need to recognize what each feature is used for.
And we'll start that discussion here
with IP version six Router Advertisement Guard,
or RA Guard.
In IP version six networks,
devices will periodically
send out RA messages via multicast.
These RA messages help network nodes determine information
about the local area network,
such as the default gateway,
the default routers list,
the network prefix list,
and other information.
The RA Guard feature allows us to block
or reject unwanted RA messages that might arrive.
We would configure this in layer two
or layer three switch where hosts or routers are attached
in order to restrict incoming router type NDP messages,
NDP meaning Network Discovery Protocol.
It's possible that we simply have unwanted RAs arriving
or that we have rogue RAs arriving
that are attempting to perform malicious actions.
RA Guard requires a policy to be configured
for blocking these unwanted RAs,
and the policy is enabled on a per interface basis
or at the VLAN level.
RA messages are unsecured,
which makes them susceptible to network attacks
such as address spoofing.
RA messages can be validated
by certain attributes found within the message,
including the source MAC address,
the source IP version six address,
the source IP version six address prefix,
a hop count limit,
a router preference priority list,
and certain configuration flags.
You'll also want to know that in general,
we have two modes used with RA Guard.
We have host mode and router mode.
In host mode,
all router advertisements are disallowed on the port
or on the VLAN where that is configured.
In router mode,
all messages are allowed on the port or VLAN,
including router solicitation, router advertisement,
and redirect messages.
This can be more granularly controlled
through more in-depth configuration
so instead of allowing or disallowing everything,
you can allow or disallow specific messages.
So that's a look at IP version six RA Guard.