- [Instructor] If you're familiar with the concept
of DHCP snooping for IP version four,
then DHCP version six Guard is a very similar feature
for IP version six networks.
DHCP version six Guard blocks DHCP reply
and advertisement messages that originate
from unauthorized DHCP servers
or DHCP relay agents in order to prevent rogue servers
from handing out addresses on our network.
Very similar to what we looked at with RA Guard,
DHCP version six Guard requires first a policy
to be configured in DHCP Guard configuration mode,
and then that policy can be applied on a per interface basis
or at the VLAN level,
applying the policy itself to the selected interfaces.
Let's say we have a switch in our network
and off of Gig 0/1,
we have a legitimate DHCP server that we do want to trust.
In order to configure DHCP version six Guard for this,
we would first create a policy
with the command IP version six DHCP guard policy
followed by the name of the policy.
In this example,
you can see that's named POLICY_NAME in all caps.
Once created, we use the command device-role
followed by either the keyword client or server.
In this particular example,
we've used the keyword server
because this port is facing our legitimate server
and we want to use the server keyword.
Once this policy is created,
we simply go under interface configuration mode
on the port that is connected
to our trusted DHCP server,
which in this case would be Gig 0/1.
And we would use the command IP version six DHCP Guard
followed by the keyword attach-policy,
which is going to attach a specific policy
to this interface.
And then, of course,
we would call out the name of the policy
that we want to use,
which in this example is POLICY_NAME,
the policy that we just created
in the previous command line output.
This is going to make sure that this interface
will accept DHCP messages
from our legitimate and trusted DHCP server on the network.
The default mode of the switch is set to guard,
so by default,
all ports configured with DHCP version six
will be set in client mode if we don't specify that,
so that means that they will drop
DHCP version six server messages.
So you want to make sure
that you specifically list the trusted interface
as being in server mode when you configure this.