Mitigating Rogue RA with Port ACL

A rogue RA is a misconfigured device or a malicious user sending wrong Router Advertisements

The most common security issue, that I have found in IPv6 networks, is the rogue RA.

Rogue RA is a misconfigured device or a malicious user sending wrong Router Advertisements to all attached hosts. Those hosts will then use information contained in this rogue RA to autoconfigure themselves: of course with wrong prefix or wrong gateway information. This attack leads to either denial of service (wrong prefix) or to traffic interception (wrong gateway), in essence, this is very similar to the rogue DHCP server in IPv4.

While Cisco is developping a complete solution to this problem (notably with Secure Neighbor Discovery available since early 2009), a simple trick can also do it on platforms supporting port ACL (PACL). A PACL is an ACL which is applied on the physical port rather than on the 'interface vlan'.

The configuration below is such a PACL to prevent both the rogue RA and the rogue DHCPv6 attacks.

Quote:

ipv6 access-list ACCESS_PORT
remark Block all traffic DHCP server -> client
deny udp any eq 547 any eq 546
remark Block Router Advertisements
deny icmp any any router-advertisement
permit any any
interface gigabitethernet 1/0/1
switchport
ipv6 traffic-filter ACCESS_PORT in

Note: another way to mitigate this attack is to increase the priority of the official router with the command:

Quote:

ipv6 nd router-preference high

• Cisco
• LANs / WANs
• Security
• ACL
• IPv6
• layer 2 security
• rogue RA
• security