close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

router-advertisement-guard

date_range 20-Nov-23

arrow_backward

arrow_forward

Syntax

router-advertisement-guard {
    interface  interface-name {
        mark-interface (trusted | block);
        policy policy-name (stateful | stateless);
    }
    vlans (vlan-name | all) {
        policy policy-name (stateful | stateless);
    }
    policy policy-name {
        accept {
            match-list {
                match-criteria {
                    (match-all | match-any);
                }
                prefix-list-name prefix-list-name;
                source-ip-address-list address-list-name;
                source-mac-address-list address-list-name;
            }
            match-option {
                hop-limit {
                    (maximum | minimum) value;
                }
                managed-config-flag;
                other-config-flag;
                router-preference (high | low | medium);
            }
        }
        discard {
            prefix-list-name prefix-list-name;
            source-ip-address-list address-list-name;
            source-mac-address-list address-list-name;
        }
    }
}

Hierarchy Level

[edit forwarding-options access-security]

Description

Configure IPv6 Router Advertisement (RA) guard. In an IPv6 deployment, RA guard protects against rogue RA messages generated either maliciously or unintentionally by unauthorized or improperly configured routers connecting to the network segment. An RA guard policy is used to validate incoming RA messages on the basis of whether they match the conditions defined in a policy. The policy can be either an accept policy or a discard policy. When RA guard is enabled by using an accept policy, any RA messages that match the conditions defined in the policy are forwarded, and RA messages that do not match the conditions are dropped. When RA guard is enabled by using a discard policy, any RA messages that match the conditions are dropped, and RA messages that do not match the conditions are forwarded.

You can enable RA guard on an interface or on a VLAN. You must first configure a policy at the [edit forwarding-options access-security router-advertisement-guard] hierarchy level. The policy is then applied to an interface at the [edit forwarding-options access-security router-advertisement-guard interface interface-name] hierarchy level, or to a VLAN at the [edit forwarding-options access-security router-advertisement-guard vlan vlan-name] hierarchy level.

Note:

If you apply an RA guard policy on an interface, you must enable RA guard on the VLAN that is associated with that interface using the vlan statement at the [edit forwarding-options access-security router-advertisement-guard] hierarchy level.

You can configure RA guard to be stateless or stateful. Stateless RA guard enables a switch to examine incoming RA messages and filter each message on the basis of whether it matches the conditions configured in the policy. For example, an interface can be statically configured to forward RA messages only from predefined sources. Stateful RA guard enables a switch to learn about legitimate senders of RA messages and store this information, which is used to validate senders of subsequent RA messages. For example, an interface that is in the learning state and receives RA messages from legitimate senders dynamically transitions to the forwarding state, in which RA messages from valid senders are forwarded to their destination.

The remaining statements are explained separately. See CLI Explorer.

Required Privilege Level

interface—To view this statement in the configuration.

interface-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 15.1X53-D55.

arrow_backward PREVIOUS router-advertisement (Dynamic Profiles)

NEXT arrow_forward router-discovery

Junos CLI Reference

ON THIS PAGE

router-advertisement-guard

Syntax

Hierarchy Level

Description

Required Privilege Level

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

router-advertisement-guard

Syntax

Hierarchy Level

Description

Required Privilege Level

Release Information

Related Documentation

Stay in touch