Question

A network engineer enables IPv6 RA Guard on an access switch to prevent rogue router advertisements from client-facing ports. After applying a policy to all edge ports, the engineer notices that the legitimate upstream router connected to GigabitEthernet1/0/24 is no longer being learned as a default gateway by hosts, and no RAs are seen on downstream ports. The RA Guard policy configured is: 'ipv6 nd raguard policy CLIENT' with 'device-role host', applied on every access port including Gi1/0/24. Which action correctly resolves the issue while keeping RA Guard protection on the client ports?

Accepted Answer

Create a separate policy with 'device-role router' and apply it to Gi1/0/24, leaving the host policy on the client-facing ports

Answer

Remove RA Guard from Gi1/0/24 and rely on DHCPv6 Guard alone to validate the upstream router

Answer

Change the CLIENT policy to 'device-role monitor' so it logs but does not block RAs on any port

Answer

Add 'trusted-port' to the CLIENT policy so RAs are permitted on all ports where it is applied