RA messages are used to provide routing information to hosts, such as the default router address and subnet masks. RA Guard helps protect networks from routing attacks by blocking unauthorized RA messages, which can help prevent attackers from taking control of network routing.

RA Guard can be enabled on IPv6 routers. When RA Guard is enabled, the router will only send RA messages to hosts that are on its subnet. RA messages from routers that are not on the host's subnet will be blocked by RA Guard.

RA Guard is an important security feature that can help protect networks from routing attacks. RA Guard should be enabled on all IPv6 routers to provide maximum protection.

RA-Guard operation

Here's a detailed explanation of how RA Guard works:

1. Router Discovery

When devices join an IPv6 network, they use Neighbor Discovery Protocol (NDP) to discover the routers on the network segment. Routers periodically send Router Advertisement (RA) messages to announce their presence and provide network configuration information.

2. Protection against router ad poisoning attacks

An attacker could attempt to send spoofed RA messages, posing as a legitimate router. To prevent this, wireless switches or access points that support RA Guard inspect incoming RA messages and verify if they come from a legitimate source.

3. Allowed Routers Table

LWireless switches or access points that implement RA Guard maintain an Allowed Routers Table that contains the IPv6 addresses and MAC interfaces of authorized routers. These legitimate routers are those that have been manually configured or discovered through other secure network auto-configuration methods.

4. Rejection of unauthorized RA messages

When a switch or access point receives an RA message, it checks whether the sender (router) is in the allowed routers table. If the router is not in the table, the RA message is considered unauthorized and is discarded. This ensures that only legitimate routers can send RA messages to the network.

Tips for enabling RA Guard

• See your router's documentation for instructions on how to enable RA Guard.
• Make sure you enable RA Guard on all routers on your network.
• Create a security policy for RA Guard and ensure it adheres to it.
• Monitor your network for any signs of suspicious activity.

Advantages of using RA Guard

• Protection against router ad poisoning attacks: The main advantage of RA Guard is that it protects the network against router ad poisoning attacks. By verifying the authenticity of incoming Router Advertisement (RA) messages, RA Guard prevents unauthorized routers from sending spoofed advertisements that could redirect traffic to malicious routes or divert traffic to unwanted destinations.
• Improves IPv6 network security: By preventing unauthorized access to RA messages, RA Guard strengthens network security and ensures that only legitimate routers can advertise configuration and routing information to local devices.
• Protection against malicious traffic redirection: By ensuring that RA messages come from trusted sources, RA Guard protects against man-in-the-middle attacks and unwanted traffic redirection. This ensures that devices on the network follow the correct routing paths and prevents potential security vulnerabilities.
• Manual configuration of allowed routers: RA Guard allows network administrators to manually configure allowed routers in the authorized routers table. This gives greater control over which routers can send RA messages on the network.

Disadvantages of using RA Guard

• Additional settings: Deploying RA Guard requires additional configuration on network devices, such as switches or wireless access points. This may be an additional process that network administrators must perform to enable and maintain RA Guard functionality.
• Complexity: Some RA Guard implementations can be complex, especially on larger, more complex networks. This might require a deeper understanding of network configuration and security management.

Possible impact on connectivity: If RA Guard configuration is not done properly, it could lead to connectivity issues such as blocking legitimate RA messages. This could negatively affect the normal operation of devices on the network.