Enable IP routing function before using this feature, for details please refer to Configuring IP Routing.
When the switch receives an ingress router advertisement (RA) message, it will attempt to match the message via the RA guard. If the ingress port has the RA guard applied but is not a trusted port, the applied VLAN ID will be matched first. If the RA tag is matched with the VLAN ID, the RA guard will continue matching conditions to determine whether to forward or drop the RA message. If the RA tag is not matched with the VLAN ID, the applied interface will be matched (followed by the subsequent conditions). RA guard policy can be configured using hop-limit, managed-config-flag, other-config-flag, prefix, source-ipv6-addr, and source-mac-addr options.
RA guard function can be configured on physical interfaces, LAG ports, or in VLANs, and only checks the router advertisement (RA) packets on the untrusted ports with RA guard enabled. By default, all interfaces are untrusted with respect to RA guard. Trusted interfaces are manually specified.
- If RA guard is enabled on an untrusted interface, the RA message received on the interface will be checked by the RA guard policy. The RA packets only matched the RA guard policy can be processed and forwarded.
- If RA guard is disabled on an untrusted interface, the RA message received on the interface will not be checked by the RA guard policy. All the RA packets received on this interface are processed and forwarded without inspection.
- If RA guard is enabled on a trusted interface, the RA message received on the interface will not be checked by the RA guard policy. All the RA packets received on this interface are processed and forwarded without inspection.
Configuring RA Guard Policy
No more than one RA guard can be applied to one interface. The RAs will be forwarded only if all conditions are matched. But if "trusted-port" has been configured for the RA guard, RAs will be forwarded on the trusted port regardless.
Displaying RA Guards