Wireless Access

Reply
Occasional Contributor I
Posts: 10
Registered: ‎04-06-2007

What is RA-guard?

I am trying to figure out exactly what RA-guard is. I have guessed based on reading other messages that it is something to do with IPv6 router advertisements, but as it's now a default in quite a few roles I wanted to get into a bit more detail about what it is and why it's set to deny. This is the acl;

ip access-list session ra-guard
  ipv6  user any icmpv6 rtr-adv  deny

 

Can someone explain what this is and what it's function is in the configuration? The rule itself is interesting to me as well as it seems this is the only place that references rtr-adv, which I am assuming is icmpv6 router advertisements, so some idea of how that works would be great as well.

Guru Elite
Posts: 8,335
Registered: ‎09-08-2010

Re: What is RA-guard?

[ Edited ]

It's part of the neighbor discovery process in IPv6. The major goal is stop clients from advertising themselves as routers.

 

It could be compared to the best practice of blocking DHCP server-side traffic from clients (user any udp 68 deny).


Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
MVP
Posts: 4,238
Registered: ‎07-20-2011

Re: What is RA-guard?

[ Edited ]
New Contributor
Posts: 3
Registered: ‎02-17-2013

Re: What is RA-guard?

So this should not effect anything on the IPv4 if it only works with IPv6 correct?

Guru Elite
Posts: 8,335
Registered: ‎09-08-2010

Re: What is RA-guard?

Correct

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
New Contributor
Posts: 3
Registered: ‎02-17-2013

Internal DB under sec-auth is greyed out on master version 6.3.1.-13

Internal DB greyed out on master to create guest username/pwd but local is working, how can I fix this both master/local are on same versions also. Under Security-Auth-Servers.

 

 

New Contributor
Posts: 3
Registered: ‎02-17-2013

Re: What is RA-guard?

Thanks Sir!

Search Airheads
Showing results for 
Search instead for 
Did you mean: