DHCPv6 Guard

RA Guard closed the door on rogue Router Advertisements.
But an RA is not the only way to get an address in IPv6!

DHCPv6 is the other one and it has the exact same weakness.

DHCPv6 Solicit

In this example, PC1 has just joined the network and sends a DHCPv6 Solicit to the all-DHCP-servers multicast address FF02::1:2.

Figure 1 – A host sends a DHCPv6 Solicit to find a server

PC1 is looking for a DHCPv6 server to get an address and a DNS server.
Every DHCPv6 server on the segment receives the Solicit.

DHCPv6 Advertise

R1 answers with a DHCPv6 Advertise, sent in unicast to PC1 only.

Figure 2 – The server replies with a DHCPv6 Advertise

It carries everything PC1 asked for:

• an IPv6 address, 2001:db8:10::10, reserved for PC1

• the DNS server to use, 2001:db8:10::1

Getting an address takes four DHCPv6 messages, in this order:

• Solicit — the client looks for a server

• Advertise — the server offers an address and DNS

• Request — the client accepts the offer

• Reply — the server confirms the address for good

The attack targets the second message: whoever sends the first Advertise wins, because nobody checks it is really the server answering.

Rogue DHCPv6 Server

In this example, the Hacker answers PC1's Solicit before R1 does.

Figure 3 – A rogue Advertise from the Hacker

PC1 takes the first Advertise it receives, exactly like it trusted the first RA.
The Hacker hands out its own address as the DNS server, so every name PC1 resolves now goes through the attacker.

By using DHCPv6 Guard, you can configure your ports to only accept server messages where a server should be.
DHCPv6 Guard is based on this principle, which you can use to protect your segment.

DHCPv6 Guard Roles

With DHCPv6 Guard, you tag each port on your switch with a role: client or server.

Figure 4 – Server role on G0/0, client role on G0/1 and G0/2

In this example, G0/0 faces R1 so it gets the server role.
G0/1 and G0/2 face PC1 and the Hacker so they get the client role.

Each role decides only one thing: is a server message allowed through this port?

Server Port

This is the role for the port facing your real DHCPv6 server:

• Server messages, Advertise and Reply, are allowed through

• It is the only port where a server should ever sit

Client Ports

This is the role for every port facing an end device:

• Server messages are dropped immediately, an end device has no reason to answer a Solicit

Client messages, Solicit and Request, always pass, whatever the role.
With these roles in place, the rogue Advertise from earlier would never leave G0/2: SW1 drops it before PC1 even sees it.

Time to practice, you start with the policy for the server port.