CLI Reference Guide-R02

Chapter 28 | IP Interface Commands
ND Snooping
– 850 –
according to the Prefix Information option in the RA message. The prefix
table records prefix, prefix length, valid lifetime, as well as the VLAN and
port interface which received the message.
■
If an RA message is not received updating a table entry with the same
prefix for a specified timeout period, the entry is deleted.
◆ Once ND snooping is enabled both globally and on the required VLANs, the
switch will start monitoring NS messages to build a dynamic user binding table
for use in Duplicate Address Detection (DAD) or for use by other security
filtering protocols (e.g., IPv6 Source Guard) as described below:
■
If an NS message is received on an trusted interface, it is forwarded without
further processing.
■
If an NS message is received on an untrusted interface, and the address
prefix does not match any entry in the prefix table, it drops the packet.
■
If the message does match an entry in the prefix table, it adds an entry to
the dynamic user binding table after a fixed delay, and forwards the packet.
Each entry in the dynamic binding table includes the link-layer address,
IPv6 address, lifetime, as well as the VLAN and port interface which received
the message.
■
If an RA message is received in response to the original NS message
(indicating a duplicate address) before the dynamic binding timeout period
expires, the entry is deleted. Otherwise, when the timeout expires, the
entry is dropped if the auto-detection process is not enabled.
■
If the auto-detection process is enabled, the switch periodically sends an
NS message to determine is the client still exists. If it does not receive an RA
message in response after the configured timeout, the entry is dropped. If
the switch receives an RA message before the timeout expires, it resets the
lifetime for the dynamic binding, and the auto-detection process resumes.
Example
This example enables ND snooping globally and on VLAN 1.
Console(config)#ipv6 nd snooping
Console(config)#ipv6 nd snooping vlan 1
Console(config)#
ipv6 nd snooping
auto-detect
This command enables automatic validation of dynamic user binding table entries
by periodically sending NS messages and awaiting NA replies. Use the no form to
disable this feature.
Syntax
[no] ipv6 nd snooping auto-detect
Default Setting
Disabled