Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 13
Abstract: The IPv6 Router Advertisement Guard (RA-Guard) mechanism is commonly employed to mitigate attack vectors based on forged ICMPv6 Router Advertisement messages. Many existing IPv6 deployments rely on RA-Guard as the first line of defense against the aforementioned attack vectors. However, some implementations of RA-Guard have been found to be prone to circumvention by employing IPv6 Extension Headers. This document describes the evasion techniques that affect the aforementioned implementations and formally updates RFC 6105, such that the aforementioned RA-Guard evasion vectors are eliminated.
Publication Date: 2014-02-01
Status Note: Informational
DOI: 10.17487/RFC7113
Link: https://doi.org/10.17487/RFC7113
Author(s): Fernando Gont

Latest version of IETF RFC 7113

Document Versions — IETF RFC 7113

▶ IETF RFC 7113 (2014-02-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 3315 [Superseded*]
IETF RFC 4303 [Active*]
IETF RFC 4861 [Active*]
IETF RFC 5722 [Active*]
IETF RFC 6105 [Active*]
IETF RFC 6980 [Active*]
IETF RFC 7045 [Active*]
IETF RFC 7112 [Active*]

Bibliographic Reference(s)

"NDPMon - IPv6 Neighbor Discovery Protocol Monitor", < http://ndpmon.sourceforge.net/ >. EXTERNAL
IANA, "Assigned Internet Protocol Numbers", < http://www.iana.org/assignments/protocol-numbers/ >. EXTERNAL
"The Hacker's Choice IPv6 Attack Toolkit", < http://www.thc.org/thc-ipv6/ >. EXTERNAL
"rafixd", < http://www.kame.net/dev/cvsweb2.cgi/kame/ kame/kame/rafixd/ >. EXTERNAL
SI6 Networks, "IPv6 NIDS evasion and improvements in IPv6 fragmentation/reassembly", 2012, < http://blog.si6networks.com/2012/02/ ipv6-nids-evasion-and-improvements-in.html >. EXTERNAL
"ramond", < http://ramond.sourceforge.net/ >. EXTERNAL
Gont, F., Liu, W., and G. Van de Velde, "DHCPv6- Shield: Protecting Against Rogue DHCPv6 Servers", Work in Progress, October 2013. EXTERNAL
Gont, F., "Security Assessment of the Internet Protocol version 6 (IPv6)", UK Centre for the Protection of National Infrastructure, (available on request). EXTERNAL
"SI6 Networks' IPv6 toolkit", < http://www.si6networks.com/tools/ipv6toolkit >. EXTERNAL
IETF RFC 6104 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC7113.json

Amends:

IETF RFC 6105 [Active*]

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 7113, Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard). Available at https://doi.org/10.17487/RFC7113

Snippet:

IETF RFC 7113, Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard). Available at https://doi.org/10.17487/RFC7113

HTML (ISO 690 compliant)

Preview:

IETF RFC 7113, Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard). Available at https://doi.org/10.17487/RFC7113

Snippet:

<span class="citation"><cite>IETF RFC 7113</cite>, Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard). Available at <a href="https://doi.org/10.17487/RFC7113" target="_blank" rel="noopener">https://doi.org/10.17487/RFC7113</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 7113, Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)
doi: 10.17487/RFC7113
url: https://doi.org/10.17487/RFC7113

Snippet:

<li>
<cite id="bib-rfc7113">IETF RFC 7113</cite>, Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)
<span class="doi">10.17487/RFC7113</span>
</li>

Referenced By

IETF RFC 7217 [Active*]
IETF RFC 7610 [Active*]
IETF RFC 8910 [Active*]