ECS4110-28P_Management Guide

C HAPTER 46 | IP Interface Commands
ND Snooping
– 1460 –
COMMAND USAGE
◆ Use this command without any keywords to enable ND snooping
globally on the switch. Use the VLAN keyword to enable ND snooping
on a specific VLAN or a range of VLANs.
◆ Once ND snooping is enabled both globally and on the required VLANs,
the switch will start monitoring RA messages to build an address prefix
table as described below:
■
If an RA message is received on an untrusted interface, it is
dropped. If received on a trusted interface, the switch adds an entry
in the prefix table according to the Prefix Information option in the
RA message. The prefix table records prefix, prefix length, valid
lifetime, as well as the VLAN and port interface which received the
message.
■
If an RA message is not received updating a table entry with the
same prefix for a specified timeout period, the entry is deleted.
◆ Once ND snooping is enabled both globally and on the required VLANs,
the switch will start monitoring NS messages to build a dynamic user
binding table for use in Duplicate Address Detection (DAD) or for use by
other security filtering protocols (e.g., IPv6 Source Guard) as described
below:
■
If an NS message is received on an trusted interface, it is forwarded
without further processing.
■
If an NS message is received on an untrusted interface, and the
address prefix does not match any entry in the prefix table, it drops
the packet.
If the message does match an entry in the prefix table, it adds an
entry to the dynamic user binding table after a fixed delay, and
forwards the packet. Each entry in the dynamic binding table
includes the link-layer address, IPv6 address, lifetime, as well as
the VLAN and port interface which received the message.
■
If an RA message is received in response to the original NS
message (indicating a duplicate address) before the dynamic
binding timeout period expires, the entry is deleted. Otherwise,
when the timeout expires, the entry is dropped if the auto-detection
process is not enabled.
■
If the auto-detection process is enabled, the switch periodically
sends an NS message to determine is the client still exists. If it does
not receive an RA message in response after the configured
timeout, the entry is dropped. If the switch receives an RA message
before the timeout expires, it resets the lifetime for the dynamic
binding, and the auto-detection process resumes.