300-410 · Question #23
Which statement about IPv6 RA Guard is true?
The correct answer is A. It does not offer protection in environments where IPv6 traffic is tunneled. IPv6 RA Guard is designed to protect against rogue Router Advertisements (RAs) but is ineffective in tunnel environments because the original RA packets are encapsulated and cannot be inspected.
Question
Options
- AIt does not offer protection in environments where IPv6 traffic is tunneled
- BIt cannot be configured on a switch port interface in the ingress direction.
- CPackets that are dropped by IPv6 RA Guard cannot be spanned.
- DIt is not supported in hardware when TCAM is programmed.
How the community answered
(53 responses)- A91% (48)
- B2% (1)
- C6% (3)
- D2% (1)
Why each option
IPv6 RA Guard is designed to protect against rogue Router Advertisements (RAs) but is ineffective in tunnel environments because the original RA packets are encapsulated and cannot be inspected.
IPv6 RA Guard operates by inspecting Router Advertisement (RA) messages directly. In tunneled environments, such as VPNs or GRE tunnels, the original RA packets are encapsulated within another header, preventing RA Guard from inspecting their contents and thus making it unable to offer protection against rogue RAs within the tunnel.
IPv6 RA Guard is specifically designed to be configured on switch port interfaces, usually in the ingress direction, to filter incoming RA messages.
Packets dropped by IPv6 RA Guard can generally still be spanned (mirrored) for analysis using features like SPAN (Switched Port Analyzer) if the spanning occurs before the drop.
IPv6 RA Guard is supported in hardware on many modern Cisco switches, utilizing TCAM for efficient packet filtering and forwarding decisions.
Concept tested: IPv6 RA Guard limitations in tunneled environments
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6/configuration/xe-16/ipv6-xe-16-book/ipv6-ra-guard.html
Topics
Community Discussion
No community discussion yet for this question.