RA-Guard

Stands for: IPv6 Router Advertisement Guard

A switch feature that drops IPv6 Router Advertisements arriving on ports where no router is supposed to be.

RA-Guard (RFC 6105) is the practical answer to rogue router advertisements, which are far more often a misconfigured host than an attacker. It filters in the layer 2 fabric as a lighter alternative to SEND, and works only where hosts' traffic passes through switches that apply it.

In its simplest form the switch is told which port leads to the router: that port may forward RAs and every other port blocks them. RFC 6105 also allows other criteria, SEND status among them, and RFC 9099 still recommends RA-Guard as a first line of defence against common attacks and misconfigured hosts.

Early implementations could be bypassed by hiding the RA behind IPv6 extension headers, and in 2014 RFC 7113 reported the fragment variant effective against every existing implementation. Its rules are the test of a good one: pass packets whose source is not link-local or whose hop limit is not 255, since neither can be a valid RA; parse the entire header chain; drop first fragments that do not contain it; log what is dropped. RFC 6980 has since made fragmented ND messages invalid.

Its limits are topological. It does nothing on shared media or where hosts reach each other without crossing a controlled switch, and RFC 9099 warns it may not work as expected where several routers share a link. Rogue DHCPv6 servers need the companion filter, DHCPv6-Shield (RFC 7610), which discards server messages except on designated ports.

Also known as: ra guard, ipv6 ra guard, router advertisement guard, rfc 6105

Sources

← All glossary entries