Web Management Guide-R01

Chapter 12 | Security Measures
ND Snooping
– 368 –
target still exists and updates the lifetime of the binding; otherwise, it deletes the
binding.
Usage Guidelines
◆ ND snooping must be enabled globally on the switch and on a specific VLAN or
a range of VLANs.
◆ Once ND snooping is enabled both globally and on the required VLANs, the
switch will start monitoring RA messages to build an address prefix table as
described below:
■
If an RA message is received on an untrusted interface, it is dropped. If
received on a trusted interface, the switch adds an entry in the prefix table
according to the Prefix Information option in the RA message. The prefix
table records prefix, prefix length, valid lifetime, as well as the VLAN and
port interface which received the message.
■
If an RA message is not received updating a table entry with the same
prefix for a specified timeout period, the entry is deleted.
◆ Once ND snooping is enabled both globally and on the required VLANs, the
switch will start monitoring NS messages to build a dynamic user binding table
for use in Duplicate Address Detection (DAD) or for use by other security
filtering protocols (e.g., IPv6 Source Guard) as described below:
■
If an NS message is received on an trusted interface, it is forwarded without
further processing.
■
If an NS message is received on an untrusted interface, and the address
prefix does not match any entry in the prefix table, it drops the packet.
■
If the message does match an entry in the prefix table, it adds an entry to
the dynamic user binding table after a fixed delay, and forwards the packet.
Each entry in the dynamic binding table includes the link-layer address,
IPv6 address, lifetime, as well as the VLAN and port interface which received
the message.
■
If an RA message is received in response to the original NS message
(indicating a duplicate address) before the dynamic binding timeout period
expires, the entry is deleted. Otherwise, when the timeout expires, the
entry is dropped if the auto-detection process is not enabled.
■
If the auto-detection process is enabled, the switch periodically sends an
NS message to determine is the client still exists. If it does not receive an RA
message in response after the configured timeout, the entry is dropped. If
the switch receives an RA message before the timeout expires, it resets the
lifetime for the dynamic binding, and the auto-detection process resumes.
ND Snooping Global
Configuration
Use the Security > ND Snooping > Configure Global page to enable ND snooping
globally on the switch.