A regional hospital finds that hosts accepted an IPv6 default router from a router advertisement that arrived on an access port. Which first-hop feature drops those advertisements on untrusted access ports?
Select an answer to reveal the explanation.
Short Explanation
A stranger walked into the ward and handed out a new map to the exit. You stop that with IPv6 RA Guard, trusting only the port toward the real router and dropping router advertisements on the access ports. ARP inspection checks a different story, and it does not read those advertisements.
Full Explanation
IPv6 RA Guard validates router advertisements. Access ports are left untrusted so a host cannot announce itself as a default router, and the port that faces the real router is trusted so legitimate advertisements still pass. That is the feature that matches the hospital's rogue advertisement. Dynamic ARP Inspection checks ARP against DHCP snooping bindings or a static ARP ACL. It does not parse IPv6 router advertisements, so it will not drop this message. IP Source Guard filters traffic against an IP binding so a host cannot use an address it was not given. It does not specifically drop router advertisements. MACsec encrypts frames on a link. It does not decide which port is allowed to send a router advertisement, and turning it on does not remove a rogue router that is allowed to talk on the VLAN. Caveat: the uplink or router port has to be trusted, or RA Guard will also drop the real default router and the hosts will lose their gateway. Operational check: enable RA Guard on the access VLAN, trust only the router-facing port, and confirm a test advertisement from an access port is dropped while the real router is still learned.