A sanitation department sees rogue IPv6 Neighbor Advertisements claiming city gateway MACs on access VLANs. Which switch feature should the team enable to inspect and validate Neighbor Discovery messages and mitigate ND spoofing?
Select an answer to reveal the explanation.
Short Explanation
ND spoofing is like someone putting fake street signs on the block so traffic drives into the wrong driveway. ND inspection/snooping lets the switch check Neighbor Discovery messages against what it trusts before hosts rewrite their neighbor cache. That keeps civic gateways from being impersonated on the access VLAN.
Full Explanation
IPv6 Neighbor Discovery spoofing lets an attacker publish rogue Neighbor Advertisements that claim civic gateway MAC addresses, steering sanitation-site traffic toward a malicious host. IPv6 ND inspection (ND snooping) is the switch feature built to inspect Neighbor Discovery messages on access VLANs and validate them against trusted bindings, which is the direct mitigation when rogue NAs appear on closet ports. Enabling that inspection keeps first-hop reachability honest without abandoning IPv6 on municipal access layers.
Disabling all Router Advertisements citywide and forcing every host onto DHCPv4 only does not validate ND messages; it abandons IPv6 rather than securing Neighbor Discovery. Relying solely on IPv4 DHCP snooping binding tables cannot authorize IPv6 neighbor claims because those tables track IPv4 DHCP leases, not IPv6 ND state. Turning off RA Guard because ND inspection supposedly covers RA forgery alone confuses complementary controls: RA Guard specifically targets Router Advertisement threats, while ND inspection targets broader ND validation—disabling RA Guard weakens the layered defense civic access switches need.
Exam caveat: ND inspection and RA Guard are related but not interchangeable; platforms and software trains expose slightly different feature names and binding sources, so map the exact IOS XE capability to the ND threat in scope. Operational check: enable IPv6 ND inspection (and retain RA Guard where required), confirm trusted ports and binding sources, then attempt a controlled rogue NA in a lab VLAN and verify the switch drops or logs the forged Neighbor Advertisement before promoting the policy citywide.