Course contents

Chapter 12: Security FundamentalsLesson 6 of 14

Beyond CCNA (optional). This topic is not on the CCNA 200-301 exam. It is useful at work and in later study; skip it if you are preparing for the exam. (Layer 2 security on the v1.1 exam is DHCP snooping, DAI and port security (5.7).)

IPv6 RA guard

Rogue IPv6 Router Advertisements and how RA guard drops them on host ports while allowing them from the real router.

Intermediate · 9 min read

Technical definition

RA guard (Router Advertisement guard) is a switch feature, described in RFC 6105, that inspects IPv6 Router Advertisements and drops those arriving on ports where no router should be. Ports are given a role: on host ports RAs are dropped, on router ports they are allowed.

A laptop that thinks it is a router

PCs on VLAN 10 get their IPv6 settings with SLAAC: R1 sends Router Advertisements (RAs) with the prefix 2001:db8:acad:10::/64, and every host builds its own address and uses R1's link-local address, fe80::1, as its default gateway. Then a laptop on Gi1/0/5 starts sending RAs of its own, perhaps from connection sharing switched on by mistake, perhaps on purpose. Hosts accept RAs from anyone on the link, so they add the laptop as a gateway and may start sending traffic through it.

Gi1/0/1Gi1/0/5Gi1/0/24Gi0/1R1IPv6 fe80::1SW1Gi1/0/24: router portPC AGi1/0/1 · host portsends RAsLaptopGi1/0/5 · host port

Device key: R1 (router) · SW1 (switch) · PC A (computer)

Lines show the example’s network connections. The coloured path and envelope follow the current step; its text identifies the sender, receiver and traffic type.

Reading the addresses

IP labels identify interfaces or destinations. Subnet labels identify networks; /n is the prefix length. A router ID (RID) identifies a routing process and need not be a reachable interface.

An IP address alone is not a URL. A web URL includes a scheme such as https://; an address on a router or printer does not imply a website.

  • R1: IPv6 fe80::1
  • SW1: Gi1/0/24: router port
  • PC A: Gi1/0/1 · host port
  • Laptop: Gi1/0/5 · host port
  1. 1. The real RA: R1 advertises 2001:db8:acad:10::/64 and itself as the default router. PC A builds an address and uses fe80::1 as its gateway.
  2. 2. A rogue RA without RA guard: The laptop advertises itself as a router. PC A adds it as a default router and may send off-link traffic to it.
  3. 3. With RA guard: Gi1/0/5 has a host policy, so SW1 drops every RA arriving there. Only Gi1/0/24, with a router policy, may bring RAs in.

Why a rogue RA is dangerous

A Router Advertisement tells hosts which prefixes are on the link, whether to use SLAAC or DHCPv6, and which router to use as the default gateway. IPv6 hosts trust any RA they receive. A rogue one can:

  • Redirect traffic: the sender becomes a default gateway, so it can read or change traffic (a man-in-the-middle attack).
  • Break connectivity: a wrong prefix or a router that goes nowhere leaves hosts with addresses that do not work.
  • Remove the real router: an RA with router lifetime 0 sent in R1's name tells hosts to stop using it.

This is the IPv6 version of the rogue DHCP server in the DHCP snooping lesson, and the cure is the same idea: the switch knows which port a message came in on, and only one port leads to the real router.

Host and router ports

RA guard is configured as a policy that says what kind of device sits behind a port, and the policy is attached to ports:

Host and router ports
Host and router portsDevice role; Where; Router Advertisements arriving on the port. host (the default role): Access ports for PCs, printers, phones Dropped router: The port towards the real router or distribution switch AllowedDevice roleWhereRouter Advertisements arriving on theporthost (the default role)Access ports for PCs, printers,phonesDroppedrouterThe port towards the real router ordistribution switchAllowed

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

RA guard filters RAs arriving from a port. It does not stop the hosts on a host port receiving R1's legitimate RAs, which arrive on the router port.

Configuring RA guard

ipv6 nd raguard policy HOST-PORTS device-role host ! interface range GigabitEthernet1/0/1 - 23 ipv6 nd raguard attach-policy HOST-PORTS

SW1, IOS XE. Every access port drops incoming Router Advertisements. device-role host is the default, but writing it makes the intent clear.

ipv6 nd raguard policy ROUTER-PORT device-role router ! interface GigabitEthernet1/0/24 ipv6 nd raguard attach-policy ROUTER-PORT

The uplink towards R1 may bring RAs in. A port with no policy attached is not filtered either, but an explicit router policy records the port's role for whoever reads the configuration next.

The exact commands vary a little between switch platforms and software versions; older Catalyst models use ipv6 nd raguard directly on the interface. Check the configuration guide for your platform. The idea is the same everywhere: drop RAs on host ports, allow them on router ports.

Verifying RA guard

Example output written for this lesson, based on Cisco IOS XE documentation
SW1#show ipv6 nd raguard policy HOST-PORTS
Policy HOST-PORTS configuration:
  device-role host
Policy HOST-PORTS is applied on the following targets:
Target               Type  Policy               Feature        Target range
Gi1/0/1              PORT  HOST-PORTS           RA guard       vlan all
Gi1/0/2              PORT  HOST-PORTS           RA guard       vlan all
Gi1/0/5              PORT  HOST-PORTS           RA guard       vlan all
This shows the named policy's role and its attachments. A port missing from this named-policy list needs further inspection; it may have another policy. The output is shortened here; the example list continues to Gi1/0/23. Attachment output alone does not prove that unwanted advertisements are being dropped.

In this single-router lab, Windows ipconfig is expected to show fe80::1 as the IPv6 default gateway. In another network, multiple legitimate routers may advertise. A second gateway is a reason to investigate, not proof of a rogue RA. Compare every listed router with the intended design and the interface on which its advertisements arrive.

Separate configuration evidence from forwarding evidence. In an isolated authorised lab, compare the host's router list before and after a controlled advertisement from the host-facing port; also confirm R1's legitimate advertisements still arrive. Correlate the source, ingress port and observed host result with the switch policy. One gateway snapshot cannot establish where filtering occurred or prove that the protection covers every packet form.

Router-list basis: RFC 4861, processing Router Advertisements. This is a verification plan, not a claim that packets or switch commands were executed for this lesson.

Header inspection and host rejection are different checks

IPv6 extension headers are extra headers between the main IPv6 header and the message being carried. RA Guard must identify the advertisement through that header chain; checking only the first header can miss it. RFC 7113 gives implementation guidance. Support must be checked for the exact hardware and release rather than inferred from the feature name.

There is also a host-side rule: RFC 6980 requires nodes to ignore Router Advertisements carried with an IPv6 Fragmentation Header. A host ignoring a fragmented RA does not by itself prove RA Guard filtered it. Correlate switch-side observations with the host result before assigning the drop to one device. This does not mean all fragmented IPv6 traffic is forbidden.

Mistakes to avoid

  • A host policy on the uplink. R1's own RAs are dropped, so hosts never learn the prefix or the gateway and IPv6 stops working on the whole VLAN.
  • Forgetting the IPv4-only VLANs. A rogue RA works there too, because hosts have IPv6 enabled.
  • Treating RA guard as complete IPv6 protection. It covers RAs only. DHCPv6 guard covers rogue DHCPv6 servers, and other first-hop security features cover spoofed neighbour messages.

Remember: RA guard drops IPv6 Router Advertisements arriving on ports with the host role and allows them on ports with the router role. It stops a device on an access port from making itself the hosts' default gateway. Configure a policy with ipv6 nd raguard policy and attach it with ipv6 nd raguard attach-policy.

RA guard in five lines

What to remember
  • IPv6 hosts trust any Router Advertisement, so a rogue one can become their default gateway.
  • RA guard (RFC 6105) drops RAs arriving on host ports and allows them on router ports.
  • Policies set the device role; host is the default.
  • Attach host policies to access ports and a router policy to the uplink.
  • It is needed on IPv4-only VLANs too, and it complements DHCPv6 guard rather than replacing it.

Test yourself on RA guard

Predict · scenario 1

An isolated lab host ignores an RA with a Fragmentation Header. Does that alone prove the switch's RA Guard blocked it?

Predict · scenario 2

A host lists two IPv6 default routers. What can you conclude from that snapshot alone?

Predict · scenario 3

A laptop on an access port sends Router Advertisements. The port has an RA guard policy with device-role host. What does SW1 do?

Predict · scenario 4

After attaching an RA guard policy to every port, including the uplink to R1, all PCs lose their IPv6 global addresses. What is the likely cause?

Predict · scenario 5

A VLAN runs IPv4 only. Why might it still need RA guard?

Predict · scenario 6

Which statement about RA guard is true?

FAQ

Is RA guard the IPv6 version of DHCP snooping?
In spirit, yes: both trust only the ports that lead to the real infrastructure. They protect different messages. RA guard filters Router Advertisements, which tell hosts the prefix and default gateway. DHCPv6 has its own feature, DHCPv6 guard, which filters DHCPv6 server messages.
Does an IPv4-only network need RA guard?
Usually yes. Most operating systems have IPv6 enabled and will accept a Router Advertisement even when the network was never meant to run IPv6. A rogue RA can then give hosts an IPv6 gateway and route their traffic through the attacker, often without anyone noticing.
Can RA guard be bypassed?
Some implementations have missed RAs carried after IPv6 extension headers or in fragmented traffic. A recent software version alone does not prove coverage. Check the exact switch hardware, release and inspection limitations against the vendor documentation and RFC 7113. Keep software maintained and validate the supported cases in an isolated lab.