- [Instructor] The final IP version six security feature
that you want to be able to describe
in this section of the blueprint
is IP version six Source Guard.
This allows you to filter inbound traffic
on layer two switch ports that are not found
in the IP version six snooping binding table.
We mentioned this table in regard to IP version six
neighbor discovery inspection
where the table learns and stores information
related to IP version six addresses,
Mac addresses, VLAN, and interface numbers.
With IP version six Source Guard, though,
this only examines the snooping table information
and it does not add to or update the table in any way.
That's why you would use IP version six snooping
in conjunction with IP version six Source Guard
so that you can help fill up the binding table
with relevant information.
So it's important to distinguish the fact
that IP version six Source Guard
does not inspect the NDP messages
as IP version six snooping does.
IP version six Source Guard simply works in conjunction
with neighbor discovery inspection
and it references the snooping binding table.
When traffic is denied by IP version six Source Guard,
a feature called IP address Glean can also be used
to try and recover the traffic.
Essentially what IP address Glean does
is to query the DHCP server
and/or use the IP version six neighbor discovery protocol
to try and find the missing information if possible.
If the information can be found,
then IP version six address Glean
can populate the binding table
with that missing information,
and that will allow for the delivery of the traffic.
However, if the traffic arriving is from an unknown
or untrusted source,
it will be blocked.
As with other IP version six security features
we've looked at,
this involves creating a policy
and then applying that policy to an interface
or VLAN of your choosing.
Another feature that is often used in conjunction with this
is IP version six prefix guard.
This feature denies traffic
that does not have a valid prefix
or traffic that originates from a subnet
outside of the local one, in other words.
So that wraps up our look
at IP version six security features.
Again, with IP version six RA Guard,
DHCP version six guard,
IP version six ND Inspection,
and IP version six Source Guard,
with all four of those,
you simply need to be able to describe
what each of these features does
and know the key characteristics and use cases.