CCNP ENARSI lab 28 of 35
IPv6 first-hop security: rogue routers, RA guard and the binding table
Watch a rogue router hijack hosts with IPv6 router advertisements and a rogue DHCPv6 server, trace and contain it, and build the first-hop security policies (RA guard, DHCPv6 guard, binding table, source guard, ND inspection) an access switch uses to stop it.
Run this lab
It needs Lite: its 4 nodes are set to 4 vCPU and 2,560 MB in total. That fits the free demo too.
In your workspace: Shared, then CCNP ENARSI 300-410 guided labs, then 28 - IPv6 first-hop security - rogue routers RA guard and the binding table
- Level
- Intermediate
- Time
- About 60 minutes
- Nodes need
- 4 vCPU, 2,560 MB
- Smallest plan
- Lite
The scenario
Falcon Legal's office LAN runs IPv6 with SLAAC: the router R1 advertises 2001:db8:28:10::/64 and gives DNS through stateless DHCPv6. This morning laptops started using the prefix 2001:db8:bad:1::/64 and a strange DNS server. Someone left a test router (ROGUE) on desk 14, plugged into the access switch S1, and it sends router advertisements (RAs) with high router preference and runs its own DHCPv6 server.
You'll prove the attack from a host's point of view, find and contain the rogue, and prepare the IPv6 first-hop security (FHS) policies for the office's access switches.
| Device | Interface | Address | Connects to |
|---|---|---|---|
| R1 | Gi0/0 | 10.28.10.1/24, 2001:db8:28:10::1/64, fe80::1 | S1 Gi0/0 |
| ROGUE | Gi0/0 | 2001:db8:bad:1::1/64, fe80::66 | S1 Gi0/3 |
| H1 | eth0 | DHCPv4 and SLAAC | S1 Gi0/1 |
About this switch. The virtual access switch (IOSvL2) accepts FHS policies but its software data plane doesn't enforce them, and it attaches some of them only per VLAN. A physical Catalyst access switch enforces them in hardware per port. In this lab you contain the rogue with what works here, configure the policies, and learn exactly how they are attached and what each one blocks on a Catalyst. Blueprint topic 3.4 asks you to describe these features.
What you’ll practise
- Explain how rogue router advertisements and rogue DHCPv6 servers attack IPv6 hosts
- Trace a rogue device from its link-local address to a switch port and contain it
- Use default router preference as a safety net
- Configure RA guard, DHCPv6 guard and IPv6 snooping policies, and read them
- Describe DHCPv6 guard, the binding table (device tracking), ND inspection and source guard, and how each is attached on an access switch
The tasks
- See the attack from the host
- Find the rogue
- Contain it and prefer the real router
- Build RA guard policies
- The rest of the FHS toolkit
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- S1
Gi0/0to R1Gi0/0 - S1
Gi0/1to H1eth0 - S1
Gi0/3to ROGUEGi0/0
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| S1 | Cisco IOSvL2 | viosl2-adventerprisek9-m.ssa.high_iron_20200929 | 1 vCPU, 1,024 MB |
| R1 | Cisco IOSv | vios-adventerprisek9-m.spa.159-3.m9 | 1 vCPU, 512 MB |
| ROGUE | Cisco IOSv | vios-adventerprisek9-m.spa.159-3.m9 | 1 vCPU, 512 MB |
| H1 | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
CCNP ENARSI 300-410 guided labs.Open
28 - IPv6 first-hop security - rogue routers RA guard and the binding tableand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More CCNP ENARSI labs
Related labs in other courses
CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.