CloudLabBox
Try the free demo

IPv6 in practice lab 6 of 12

IPv6 security: RA guard, ACLs and firewall filters

A rogue router is handing out a bad prefix on the staff LAN. Stop it with RA guard, make the edge refuse spoofed sources with an IOS IPv6 ACL, then lock down a Junos control plane and a RouterOS management address, without breaking Neighbor Discovery on the way.

Run this lab

It needs Lite: its 5 nodes are set to 6 vCPU and 5,632 MB in total. That fits the free demo too.

In your workspace: Shared, then IPv6 in practice across vendors guided labs, then 06 - IPv6 security - RA guard ACLs and firewall filters

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
6 vCPU, 5,632 MB
Smallest plan
Lite

The scenario

Kestrel Freight's first IPv6 security review turned up three problems. Someone on the staff LAN is running a device that sends its own router advertisements. The edge router will forward any source address. And the core router's control plane answers anyone. You have to fix all three, and the review's last line says it all: "IPv6 needs ICMPv6, so filter carefully."

DeviceInterfaceAddress
SW (RouterOS bridge lan)ether1 to R1, ether2 to H1, ether3 to ROGUE2001:db8:100:10::2/64
R1Gi0/0fe80::1, 2001:db8:100:10::1/64
R1Gi0/12001:db8:100:a::1/64
SRX1ge-0/0/0, lo02001:db8:100:a::2/64, 2001:db8:100:ffff::2/128
H1eth0SLAAC
ROGUEether12001:db8:bad:1::1/64, advertising with high preference
DeviceRunsHow to log in
SW, ROGUEMikroTik RouterOS 7.14admin / Lab-admin1
R1Cisco IOSv 15.9The console opens at >; enable has no password.
SRX1Juniper vSRX 23.4lab / lab123. It takes about 10 minutes to boot.
H1Alpine Linuxroot, no password.

What you’ll practise

  • Show what a rogue RA does to a host, and contain it with an RA guard filter
  • Write an IOS IPv6 ACL that stops spoofed sources and keeps Neighbor Discovery
  • Write a Junos inet6 firewall filter that protects the routing engine
  • Protect a RouterOS device's own address with its IPv6 firewall
  • Read counters on all three to prove what each rule did

The tasks

  1. Start the Linux host
  2. See what a rogue RA does
  3. RA guard on the switch
  4. An IOS IPv6 ACL that stops spoofing
  5. A Junos filter on the control plane
  6. The RouterOS IPv6 firewall

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of IPv6 security - RA guard ACLs and firewall filters5 nodes, 4 links. Every link is listed as text below the diagram.SWR1SRX1ROGUEH1ether1Gi0/0Gi0/1ge-0/0/0ether2eth0ether3ether1
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SW ether1 to R1 Gi0/0
  • SW ether2 to H1 eth0
  • SW ether3 to ROGUE ether1
  • R1 Gi0/1 to SRX1 ge-0/0/0
Nodes in IPv6 security: RA guard, ACLs and firewall filters, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SRX1Juniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB
ROGUEMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder IPv6 in practice across vendors guided labs.

  3. Open 06 - IPv6 security - RA guard ACLs and firewall filters and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More IPv6 in practice labs

All IPv6 in practice labs

Related labs in other courses

CloudLabBox is independent of Cisco, CompTIA, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.