router-advertisement-guard
Syntax
router-advertisement-guard {
interface interface-name {
mark-interface (trusted | block);
policy policy-name (stateful | stateless);
}
vlans (vlan-name | all) {
policy policy-name (stateful | stateless);
}
policy policy-name {
accept {
match-list {
match-criteria {
(match-all | match-any);
}
prefix-list-name prefix-list-name;
source-ip-address-list address-list-name;
source-mac-address-list address-list-name;
}
match-option {
hop-limit {
(maximum | minimum) value;
}
managed-config-flag;
other-config-flag;
router-preference (high | low | medium);
}
}
discard {
prefix-list-name prefix-list-name;
source-ip-address-list address-list-name;
source-mac-address-list address-list-name;
}
}
}
Hierarchy Level
[edit forwarding-options access-security]
Description
Configure IPv6 Router Advertisement (RA) guard. In an IPv6 deployment, RA guard protects against rogue RA messages generated either maliciously or unintentionally by unauthorized or improperly configured routers connecting to the network segment. An RA guard policy is used to validate incoming RA messages on the basis of whether they match the conditions defined in a policy. The policy can be either an accept policy or a discard policy. When RA guard is enabled by using an accept policy, any RA messages that match the conditions defined in the policy are forwarded, and RA messages that do not match the conditions are dropped. When RA guard is enabled by using a discard policy, any RA messages that match the conditions are dropped, and RA messages that do not match the conditions are forwarded.
You can enable RA guard on an interface or on a VLAN. You must
first configure a policy at the [edit forwarding-options access-security
router-advertisement-guard] hierarchy level. The policy is then
applied to an interface at the [edit forwarding-options access-security
router-advertisement-guard interface interface-name] hierarchy level, or to a VLAN at the [edit forwarding-options
access-security router-advertisement-guard vlan vlan-name] hierarchy level.
If you apply an RA guard policy on an interface, you must
enable RA guard on the VLAN that is associated with that interface
using the vlan statement at the [edit forwarding-options
access-security router-advertisement-guard] hierarchy level.
You can configure RA guard to be stateless or stateful. Stateless RA guard enables a switch to examine incoming RA messages and filter each message on the basis of whether it matches the conditions configured in the policy. For example, an interface can be statically configured to forward RA messages only from predefined sources. Stateful RA guard enables a switch to learn about legitimate senders of RA messages and store this information, which is used to validate senders of subsequent RA messages. For example, an interface that is in the learning state and receives RA messages from legitimate senders dynamically transitions to the forwarding state, in which RA messages from valid senders are forwarded to their destination.
The remaining statements are explained separately. See CLI Explorer.
Required Privilege Level
interface—To view this statement in the configuration.
interface-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 15.1X53-D55.