A sanitation department sees rogue IPv6 Neighbor Advertisements claiming city gateway MACs on access VLANs. Which switch feature should the team enable to inspect and validate Neighbor Discovery messages and mitigate ND spoofing?
Select an answer to reveal the explanation.
Short Explanation
ND spoofing is like someone putting fake street signs on the block so traffic drives into the wrong driveway. ND inspection/snooping lets the switch check Neighbor Discovery messages against what it trusts before hosts rewrite their neighbor cache. That keeps civic gateways from being impersonated on the access VLAN.
Full Explanation
IPv6 Neighbor Discovery can be abused with forged Neighbor Advertisements that redirect traffic. Cisco ND inspection (often paired with RA Guard and binding tables) validates ND messages on the switch so spoofed NA/NS activity is constrained. DHCP snooping for IPv4 does not authorize IPv6 ND claims by itself. Disabling RAs citywide or assuming RA Guard is unnecessary both miss the ND-specific control plane risk this item targets.