(apologies for duplicates, thought this might be interesting for folks on both lists):
Hi, In case anyone is looking into deploying the 'ipv6 nd raguard' feature introduced in SXI4 on Cat6.5k: I suggest you don't (for now, at least). We found an issue with it causing it to intermittently drop neighbor solicits from the access port resulting in a complete IPv6 'meltdown' for the attached host (*sigh*) Bug ID: CSCtk05146 - IPv6 Solicit dropped by RAguard Verified by issuing: sh tcam interface <interface> acl in ipv6 Cisco suggests disabling it all together as a workaround, however, we found that IPv6 PACLs (also introduced in SXI4) do work fine in our limited testing so far, e.g.: ipv6 access-list block-rogue-ipv6 remark Block DHCPv6 server messages deny udp any eq 547 any eq 546 remark Block Router Advertisements deny icmp any any router-advertisement permit ipv6 any any int <interface> ipv6 traffic-filter block-rogue-ipv6 in Cheers, Daniel. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
