CCNP Security Question of the Week: Bogus IPv6 Addresses

What two features block traffic that are sourced from bogus IPv6 addresses? (Choose two.)

A. DHCPv6 Guard
B. IPv6 Prefix Guard
C. IPv6 RA Guard
D. IPv6 Source Guard

Reveal Answer

Answer: B and  D.

IPv6 Source Guard and IPv6 Prefix Guard are Layer 2 snooping features that validate the source of IPv6 traffic. IPv6 Source Guard blocks any data traffic from an unknown source. For example, one that is not already populated in the binding table or previously learned through Neighbor Discovery (ND) or Dynamic Host Configuration Protocol (DHCP) gleaning. The IPv6 Prefix Guard feature works within the IPv6 Source Guard feature, enabling the device to deny traffic originated from nontopologically correct addresses. IPv6 prefix guard is often used when IPv6 prefixes are delegated to devices (for example, home gateways) using DHCP prefix delegation. The feature discovers ranges of addresses assigned to the link and blocks any traffic sourced with an address outside this range.

Related Resources
Cisco White Papers

Related Course
CCNP Security e-Camp

CCNA Security Question of the week Series

• CCNA Security Question of the Week: Application Layer Firewall
• CCNA Security Question of the Week: Enable Secret
• CCNA Security Question of the Week: Cisco Configuration Professional
• CCNA Security Question of the Week: Secure Network Management
• CCNA Security Question of the Week: Enterprise Installation
• CCNA Security Question of the Week: Access Control List
• CCNA Security Question of the Week: ASA Access List
• CCNA Security Question of the Week: AAA Login Authentication
• CCNA Security Question of the Week: Traffic Class
• CCNA Security Question of the Week: IPS Alerts
• CCNP Security Question of the Week: IPS Anomaly Detection Features
• CCNP Security Question of the Week: Bogus IPv6 Addresses

from
CERTIVIEW