IPv6 RA Guard rejects fake RA messages coming from host (non-router) ports (not sure whether it handles all possible IPv6 header fragmentation attacks). Interestingly, it can also validate the contents of RA messages (configuration flags, list of prefixes) received through router-facing ports, potentially giving you a safeguard against an attack of fat fingers.
DHCPv6 Guard blocks DHCPv6 messages coming from unauthorized DHCPv6 servers and relays. Like IPv6 RA Guard it also validates the DHCPv6 replies coming from authorized DHCPv6 servers, potentially providing protection against DHCPv6 server misconfiguration.
IPv6 Snooping and device tracking builds a IPv6 First-Hop Security Binding Table (nicer name for ND table) by monitoring DHCPv6 and ND messages as well as regular IPv6 traffic. The binding table can be used to stop ND spoofing (in IPv4 world we’d call this feature DHCP Snooping and Dynamic ARP Inspection).
IPv6 Source Guard uses the IPv6 First-Hop Security Binding Table to drop traffic from unknown sources or bogus IPv6 addresses not in the binding table. The switch also tries to recover from lost address information, querying DHCPv6 server or using IPv6 neighbor discovery to verify the source IPv6 address after dropping the offending packet(s).
IPv6 Prefix Guard is denies illegal off-subnet traffic. It uses information gleaned from RA messages and IA_PD option of DHCPv6 replies (delegated prefixes) to build the table of valid prefixes.
Configuration:
Access-lists
CAT2(config)# ipv6 access-list ACCESS_PORT CAT2(config-ipv6-acl)# remark Block all traffic DHCP server -> client CAT2(config-ipv6-acl)# deny udp any eq 547 any eq 546 CAT2(config-ipv6-acl)# remark Block Router Advertisements CAT2(config-ipv6-acl)# deny icmp any any router-advertisement CAT2(config-ipv6-acl)# permit any any CAT2(config-ipv6-acl)# ! CAT2(config-ipv6-acl)# interface gigabitethernet 1/0/1 CAT2(config-if)# switchport CAT2(config-if)# ipv6 traffic-filter ACCESS_PORT in
RA Guard
Switch(config)# ipv6 nd raguard policy POLICY-NAME
! Defines the RA Guard policy name
Switch(config-ra-guard)# device-role {host | router}
Switch(config)# interface INTERFACE
Switch(config-if)# ipv6 nd raguard attach-policy POLICY-NAME
DHCPv6 Guard
CAT1(config)# ipv6 access-list acl1 CAT1(config-ipv6-acl)# permit host FE80::A8BB:CCFF:FE01:F700 any CAT1(config-ipv6-acl)# ipv6 prefix-list abc permit 2001:0DB8::/64 le 128 CAT1(config-ipv6-acl)# ipv6 prefix-list abc permit 2001:0DB8::/64 le 128 CAT1(config)# ipv6 dhcp guard policy pol1 CAT1(config-dhcp-guard)# device-role server CAT1(config-dhcp-guard)# match server access-list acl1 CAT1(config-dhcp-guard)# match reply prefix-list abc CAT1(config-dhcp-guard)# preference min 0 CAT1(config-dhcp-guard)# preference max 255 CAT1(config-dhcp-guard)# trusted-port CAT1(config-dhcp-guard)# interface GigabitEthernet 1/0/1 CAT1(config-if)# switchport CAT1(config-if)# ipv6 dhcp guard attach-policy pol1 vlan add 1 CAT1# show ipv6 dhcp guard policy pol1