What is a function of IPv6 ND inspection?

IPv6 Neighbor Discovery (ND) inspection is a Layer 2 security feature that mitigates attacks based on the IPv6 Neighbor Discovery Protocol. It operates by intercepting and validating ND messages (like Neighbor Solicitations and Advertisements) on a specific VLAN. By doing this, it builds a trusted binding table on the switch. This table maps a client's IPv6 address to its link-layer (MAC) address and the switch port it is connected to. This process specifically secures addresses obtained through Stateless Address Autoconfiguration (SLAAC), preventing malicious hosts from spoofing addresses or launching man-in-the-middle attacks.

A. The binding table is maintained on the Layer 2 switch and maps Layer 3 addresses to Layer 2 identifiers (MAC, port), making it a Layer 2 table, not a Layer 3 one.

C. ND inspection's primary function is to secure the Neighbor Discovery protocol, which is fundamental to stateless autoconfiguration (SLAAC), not stateful (DHCPv6) autoconfiguration.

D. This is incorrect because ND inspection secures stateless (SLAAC) addresses, and the binding table it creates is considered a Layer 2 construct on the switch.

1. Cisco Systems

Inc. (2021). IP Addressing: IPv6 Configuration Guide

Cisco IOS XE Amsterdam 17.3.x - IPv6 First-Hop Security.

Section: "Information About IPv6 Neighbor Discovery Inspection"

Quote/Content: "The IPv6 Neighbor Discovery (ND) inspection feature learns and secures bindings for IPv6 stateless autoconfiguration addresses on a Layer 2 switch. The feature analyzes Neighbor Discovery (ND) messages in order to build a trusted binding table. IPv6 ND inspection is similar to the DHCP snooping feature." This directly confirms the function relates to stateless autoconfiguration and operates at Layer 2.

2. Cisco Systems

Inc. (2023). Security Configuration Guide: Catalyst 9800 Series Wireless Controller

Cisco IOS XE Cupertino 17.9.x - Implementing IPv6 First-Hop Security.

Section: "IPv6 Neighbor Discovery Inspection"

Quote/Content: "The IPv6 ND inspection feature learns and secures bindings for IPv6 stateless autoconfiguration addresses on a Layer 2 switch. The feature analyzes ND messages to build a trusted binding table." This reiterates that the feature is for stateless autoconfiguration and is implemented on a Layer 2 device.