CCNP Security Question of the Week: Block Traffice from Bogus IPv6 Addresses

Which two features block traffic that are sourced from bogus IPv6 addresses? (Choose two.)

A. DHCPv6 Guard
B. IPv6 Prefix Guard
C. IPv6 RA Guard
D. IPv6 Source Guard

Reveal Answer

Answer: B and D.

IPv6 Source Guard and IPv6 Prefix Guard are Layer 2 snooping features that validate the source of IPv6 traffic. IPv6 Source Guard blocks any data traffic from an unknown source. For example, one that is not already populated in the binding table or previously learned through Neighbor Discovery (ND) or Dynamic Host Configuration Protocol (DHCP) gleaning. The IPv6 Prefix Guard feature works within the IPv6 Source Guard feature, enabling the device to deny traffic originated from nontopologically correct addresses. IPv6 prefix guard is often used when IPv6 prefixes are delegated to devices (for example, home gateways) using DHCP prefix delegation. The feature discovers ranges of addresses assigned to the link and blocks any traffic sourced with an address outside this range.

 

Related Resources
Cisco White Papers

Related Course
CCNP Security e-Camp

CCNP Security Question of the Week Series

• CCNP Security Question of the Week: Cisco ASA Security Context
• CCNP Security Question of the Week: Authenticating ASDM Users
• CCNP Security Question of the Week: Layer 5-7 Policy Maps
• CCNP Security Question of the Week: 802.1X
• CCNP Security Question of the Week: IPS Updates
• CCNP Security Question of the Week: IPsec VPN Tunnels
• CCNP Security Question of the Week: AnyConnect VPN Client
• CCNP Security Question of the Week: ASA AIP-SSM and ASA AIP-SSC
• CCNP Security Question of the Week: Disable DHCP Server Service
• CCNP Security Question of the Week: Cisco ASA Security Appliance Access List
• CCNP Security Question of the Week: Network Address Translation
• CCNP Security Question of the Week: Harden a Switch
• CCNP Security Question of the Week: SSH Login
• CCNP Security Question of the Week: Packet-Tracer Command
• CCNP Security Question of the Week: SSL Ciphers
• CCNP Security Question of the Week: VLAN Hopping
• CCNP Security Question of the Week: DHCP Server Service
• CCNP Security Question of the Week: Default Behavior of an Access List
• CCNP Security Question of the Week: NAT Control on Cisco ASA Version 8.3
• CCNP Security Question of the Week: IPS Anomaly Detection Features
• CCNP Security Question of the Week: Bogus IPv6 Addresses
• CCNP Security Question of the Week: Harden a Switch
• CCNP Security Question of the Week: SSH Login
• CCNP Security Question of the Week: NTP on a Cisco ASA Default Settings
• CCNP Security Question of the Week: Packet-tracer Command
• CCNP Security Question of the Week: SSL Ciphers
• CCNP Security Question of the Week: Prevent VLAN Hopping
• CCNP Security Question of the Week: Block Traffice from Bogus IPv6 Addresses

from
CERTIVIEW