RA-Guard

RA-Guard (Router Advertisement Guard) is a security feature in IPv6 that helps protect against spoofed router attacks and ensures that only legitimate router advertisements are processed and accepted by nodes on the network.

RA-Guard is deployed on network devices and examines Router Advertisement (RA) messages to detect and block unauthorized or malicious router advertisements.

When RA-Guard is enabled on a network device, it analyzes received RA messages and compares the information in them with a list of authorized routers. If the RA message does not match authorized routers or displays suspicious characteristics, the device can block the RA message, ignore it, or take other security actions defined in the settings.

Techniques to identify and block

RA-Guard uses several techniques to identify and block spoofed router ads, including:

Source filtering

RA-Guard checks the source address of the RA message and compares this address with the list of authorized routers. If the source address does not match, the RA message may be considered unauthorized and blocked.

RA Options Inspection

RA-Guard examines the options included in the RA message to detect options that are suspicious or incompatible with the expected configuration. For example, if unexpected options or incorrect configurations are found, the RA message may be considered unauthorized.

Frequency and patterns of RA messages

RA-Guard can also analyze the frequency and patterns of received RA messages. If a large number of RA messages are detected in a short period of time or if there are unusual patterns of RA messages, the device may take action to block or limit suspicious messages.

RA-Guard implementation may vary depending on the specific device and manufacturer. Some network devices have RA-Guard built in as a native functionality, while other devices may require you to enable and configure RA-Guard explicitly.

RA-Guard is an effective security measure to mitigate the risks associated with spoofed router advertisements and protect the IPv6 network against unauthorized router attacks. By enabling RA-Guard, network nodes can trust legitimate RA messages and ensure that network routers are trusted and authenticated.

DHCPv6 Secure

DHCPv6 Secure is an IPv6 security feature that provides authentication and authorization of DHCPv6 clients. Enables you to verify the identity of DHCPv6 clients and ensure that only authorized clients can obtain IPv6 addresses and network configurations.

Here's an in-depth look at how it works. DHCPv6 Secure:

DHCPv6 Client Authentication

DHCPv6 Secure uses authentication techniques to verify the identity of DHCPv6 clients. It is based on the use of X.509 certificates and digital signatures to authenticate clients. Each DHCPv6 client has a unique digital certificate that is signed by a trusted certificate authority (CA).

DHCPv6 Client Authorization

In addition to authentication, DHCPv6 Secure also allows client authorization. This means that not only is the client's identity verified, but it is also checked to see if the client has the necessary permissions to obtain an IPv6 address and the associated network configurations.

Interaction with public key infrastructure (PKI)

DHCPv6 Secure integrates with a public key infrastructure (PKI) to manage certificates and public and private keys required for authentication and digital signing. This involves configuring an internal CA or using an external trusted CA to issue and manage DHCPv6 client certificates.

Process of obtaining IPv6 addresses

When a DHCPv6 client begins the process of obtaining an IPv6 address and network settings, it sends a DHCPv6 request to the DHCPv6 server. This request contains the information necessary for authentication, such as the client's certificate and digital signature.

Certificate verification and digital signature

The DHCPv6 server verifies the client's certificate and its digital signature using the configured public key infrastructure (PKI). Verifies the authenticity of the certificate, ensuring that it came from the trusted CA and has not been revoked. It also checks the validity of the digital signature to ensure that it has not been modified in transit.

Authorization check

Once the DHCPv6 client has been successfully authenticated, the DHCPv6 server performs an authorization check to verify whether the client has the necessary permissions to obtain an IPv6 address and the associated network settings. This is based on the authorization policies defined on the DHCPv6 server.

IPv6 Address Assignment and Network Configurations

If the DHCPv6 client has been successfully authenticated and authorized, the DHCPv6 server assigns an IPv6 address and provides the corresponding network configurations to the client. These settings can include information such as the subnet mask, default gateway, DNS servers, and other network parameters.

Renewal and periodic verification

DHCPv6 Secure also includes mechanisms to periodically renew and verify IPv6 addresses and network configurations assigned to clients. This ensures that only authorized clients can maintain and use the assigned addresses and settings over time.

Deploying DHCPv6 Secure requires proper configuration of the public key infrastructure (PKI), generation and management of certificates, and configuration of authentication and authorization policies on the DHCPv6 server. Each DHCPv6 client must have a valid certificate and digitally sign its DHCPv6 requests to be properly authenticated by the DHCPv6 server.