H3C Technologies H3C S6300 Series Switches - Manual (Page 336)

321
• Enable dynamic IPv6 source guard on Ten-GigabitEthernet 1/0/1 to filter received packets based
on DHCPv6 snooping entries, allowing only packets from a client that obtains an IP address from
the DHCPv6 server to pass.
Figure 106 Network diagram
Configuration procedure
1. Configure DHCPv6 snooping:
# Enable DHCPv6 snooping globally.
system-view
[Switch] ipv6 dhcp snooping enable
# Configure the interface connecting to the DHCP server as a trusted interface.
[Switch] interface ten-gigabitethernet 1/0/2
[Switch-Ten-GigabitEthernet1/0/2] ipv6 dhcp snooping trust
[Switch-Ten-GigabitEthernet1/0/2] quit
2. Enable IPv6 source guard:
# Enable IPv6 source guard on Ten-GigabitEthernet 1/0/1 to and verify the source IP address and
MAC address for dynamic IPv6 source guard.
[Switch] interface ten-gigabitethernet 1/0/1
[Switch-Ten-GigabitEthernet1/0/1] ipv6 verify source ip-address mac-address
# Enable recording of client information in DHCPv6 snooping entries on Ten-GigabitEthernet
1/0/1.
[Switch-Ten-GigabitEthernet1/0/1] ipv6 dhcp snooping binding record
[Switch-Ten-GigabitEthernet1/0/1] quit
Verifying the configuration
# Display dynamic IPv6 source guard binding entries on the device.
[Switch] display ipv6 source binding dhcpv6-snooping
Total entries found: 1
IPv6 Address MAC Address Interface VLAN Type
2001::1 040a-0000-0001 XGE1/0/1 1 DHCPv6 snooping
The output shows that a dynamic IPv6 source guard binding entry is generated based on a DHCPv6
snooping entry.