What is RA Guard, and what other IPv6 first hop security features do you deploy on access switches?
Show the answer
Say this first
RA Guard (RFC 6105) drops Router Advertisements arriving on switch ports that are not meant to have a router behind them. It stops rogue RAs, from a misconfigured device or an attacker, that would hand hosts a new default gateway or prefix. The rest of the toolkit: DHCPv6 Guard against rogue DHCPv6 servers, a binding table built by snooping NDP and DHCPv6 (SISF device tracking on Cisco), ND inspection, IPv6 Source Guard and Destination Guard.
Go deeper
Why rogue RAs hurt
A laptop sharing its connection or a home router plugged in backwards sends RAs. Hosts add its link-local address as another default router and may build addresses from its prefix. Traffic either black-holes or goes through the attacker.
RA Guard on Cisco IOS-XE
ipv6 nd raguard policy HOSTS
device-role host
!
ipv6 nd raguard policy UPLINK
device-role router
!
interface range GigabitEthernet1/0/1 - 46
ipv6 nd raguard attach-policy HOSTS
interface GigabitEthernet1/0/48
ipv6 nd raguard attach-policy UPLINKDHCPv6 Guard
ipv6 dhcp guard policy CLIENTS
device-role client
!
interface range GigabitEthernet1/0/1 - 46
ipv6 dhcp guard attach-policy CLIENTSThe rest
| Feature | What it does |
|---|---|
| Device tracking (SISF) | binding table of address, MAC, port and VLAN from NDP and DHCPv6 |
| ND inspection | drops NS and NA that contradict the binding table |
| Source Guard | drops traffic sourced from addresses not in the binding table |
| Destination Guard | drops traffic to addresses with no binding, limiting NDP cache exhaustion |
Evasion
Attackers hid RAs behind extension headers or fragments so the switch could not see the ICMPv6 type.
RFC 7113 says RA Guard must parse the whole header chain and drop what it cannot parse, and RFC 7112 requires
the whole chain in the first fragment. On Cisco a port ACL with deny ipv6 any any undetermined-transport
closes the gap on older code.
They will ask next
How do you find a rogue router quickly before RA Guard is in place?
Run
rdisc6 eth0(or checkshow ipv6 routerson a router) to list who is sending RAs and their link-local addresses. Turn the link-local into a MAC (EUI-64 or the NDP cache), thenshow mac address-table addresson the switch to find the port.Does RA Guard protect a wireless network?
Only if the wireless side does it too. Clients on the same SSID talk through the AP or controller, not through a wired access port, so enable the controller's RA filtering as well.
Traps
- Applying RA Guard with a host policy on the uplink to the real router.
- Forgetting DHCPv6 Guard, which is the same problem for DHCPv6.