(0002486)
chiwawa_42 (reporter)
2011-12-29 08:32
|
required IPv6 feature set :
- Implement NDP / RA filtering on switches supporting PACL but not RA-Guard (RFC 6105)
- Use NDPMon (similar to ARPWatch) for monitoring
- Enforce loose (counter-RA) or strict (+port shutdown) policy on rogue-RA detection
- Implement DHCPv6 snooping and/or stateless option server (coupled to 802.1x auth process)
- OS validation for IPv6 capabilities to eventually disable IPv6 trafic for incapable hosts (DHCPv6 only on 7 and Lion, RA-flood bug on XP...) |