Question

An engineer enabled IPv6 RA Guard on an access switch to prevent rogue router advertisements from client-facing ports. After deployment, clients on VLAN 30 no longer receive default gateway information, and 'show ipv6 nd raguard policy HOST_POLICY' shows the policy is applied to all VLAN 30 access ports. The legitimate router is connected to GigabitEthernet1/0/48, which is also configured with the HOST_POLICY. What is the most likely cause and correct remediation?

Accepted Answer

The uplink port to the legitimate router has a host-role RA Guard policy that drops all RAs; apply a policy with 'device-role router' (or trust) on Gi1/0/48.

Answer

RA Guard requires an IPv6 binding table entry for the router; enable IPv6 DHCP snooping on VLAN 30 to populate the table before RAs are permitted.

Answer

RA Guard only inspects DHCPv6 Advertise messages, so the switch is dropping SLAAC RAs; disable SLAAC on the router and use stateful DHCPv6 instead.

Answer

The RA Guard policy is missing a maximum hop-limit value; configure 'hop-limit maximum 255' in HOST_POLICY to allow the router's RAs through.