NOTE:
Enable IP routing function before using this feature, for details please refer to Configuring IP Routing.
When the switch receives an ingress router advertisement (RA) message, it will attempt to match the message via the RA guard. If the ingress port has the RA guard applied but is not a trusted port, the applied VLAN ID will be matched first. If the RA tag is matched with the VLAN ID, the RA guard will continue matching conditions to determine whether to forward or drop the RA message. If the RA tag is not matched with the VLAN ID, the applied interface will be matched (followed by the subsequent conditions). RA guard policy can be configured using hop-limit, managed-config-flag, other-config-flag, prefix, source-ipv6-addr, and source-mac-addr options.
admin@XorPlus# set protocols neighbour ra-guard term 1 from hop-limit 1 admin@XorPlus# set protocols neighbour ra-guard term 1 from managed-config-flag false admin@XorPlus# commit Waiting for merging configuration. Commit OK. Save done. admin@XorPlus# set protocols neighbour ra-guard term 2 from prefix 2001:1:1:1::/64 admin@XorPlus# commit Waiting for merging configuration. Commit OK. Save done. admin@XorPlus# set protocols neighbour ra-guard term 3 from source-mac-addr 22:22:22:22:22:22 admin@XorPlus# commit Waiting for merging configuration. Commit OK. Save done. admin@XorPlus#
Configuring Trusted-Port
RA guard can be applied to physical interfaces, LAGs, or VLANs. No more than one RA guard can be applied to one interface. The RAs will be forwarded only if all conditions are matched. But if "trusted-port" has been configured for the RA guard, RAs will be forwarded on the trusted port regardless.
admin@XorPlus# set protocols neighbour ra-guard term 1 interface ge-1/1/1 admin@XorPlus# set protocols neighbour ra-guard term 1 interface ae1 admin@XorPlus# set protocols neighbour ra-guard term 1 vlan-id 2 admin@XorPlus# commit Waiting for merging configuration. Commit OK. Save done. admin@XorPlus#set protocols neighbour ra-guard trusted-port ge-1/1/1 admin@XorPlus# commit Waiting for merging configuration. Commit OK. Save done. admin@XorPlus# set protocols neighbour ra-guard term 2 vlan-id 3 admin@XorPlus# commit Waiting for merging configuration. Commit OK. Save done. admin@XorPlus#
Displaying RA Guards
admin@XorPlus# run show ra-guard
Ra-guard: 1
cur hop limit : 1..1
managed configuration: Unset
interface : ae1
vlan : 2
packet dropped : 0
packet total : 0
Ra-guard: 2
prefix : 2001:1:1:1::/64
vlan : 3
packet dropped : 0
packet total : 0
Ra-guard: 3
source mac address: 22:22:22:22:22:22
packet dropped : 0
packet total : 0
admin@XorPlus# run show ra-guard name 1
Ra-guard: 1
cur hop limit : 1..1
managed configuration: Unset
interface : ae1
vlan : 2
packet dropped : 0
packet total : 0