A network engineer is deploying IPv6 First Hop Security on an access switch. IPv6 Source Guard is configured on the host-facing ports, but legitimate hosts are being dropped even though they are using valid autoconfigured addresses. The engineer confirms that RA Guard and DHCP Guard are working correctly, but 'show ipv6 neighbor binding' returns an empty table for the affected ports. Which additional feature must be enabled to populate the binding table so Source Guard permits these hosts?