NDP 安全：防御 IPv6 网络攻击

合法：2001:db8::100 → MAC aa:bb:cc:dd:ee:ff
攻击：  2001:db8::100 → MAC 11:22:33:44:55:66（攻击者）

┌─────────────────────────────────────────┐
│          交换机端口类型                  │
├─────────────────────────────────────────┤
│ 主机端口：阻止所有 RA                   │
│ 路由器端口：允许来自受信任 IP 的 RA     │
└─────────────────────────────────────────┘

! 为受信任的路由器定义 IPv6 访问列表
ipv6 access-list TRUSTED-ROUTERS
 permit ipv6 host 2001:db8::1 any
 permit ipv6 host 2001:db8::2 any
 
! 创建 RA Guard 策略
ipv6 nd raguard policy HOST-POLICY
 device-role host
 
ipv6 nd raguard policy ROUTER-POLICY
 device-role router
 match ipv6 access-list TRUSTED-ROUTERS
 
! 应用于 VLAN
interface range GigabitEthernet1/0/1-48
 description Access ports
 ipv6 nd raguard attach-policy HOST-POLICY
 
interface GigabitEthernet1/0/49
 description Uplink to router
 ipv6 nd raguard attach-policy ROUTER-POLICY

# 在访问端口上定义 RA Guard
set protocols router-advertisement interface ge-0/0/0.0 no-advertise
 
# 在上行链路上允许 RA
set protocols router-advertisement interface ge-0/0/23.0

# 在网桥端口上启用 RA Guard
echo 1 > /sys/class/net/vnet0/brport/protect_ra
 
# 或使用 ebtables
ebtables -A FORWARD -p IPv6 --ip6-proto ipv6-icmp \
  --ip6-icmp-type router-advertisement -i vnet0 -j DROP

ipv6 dhcp guard policy CLIENT-POLICY
 device-role client
 
ipv6 dhcp guard policy SERVER-POLICY
 device-role server
 
interface range GigabitEthernet1/0/1-48
 ipv6 dhcp guard attach-policy CLIENT-POLICY
 
interface GigabitEthernet1/0/49
 ipv6 dhcp guard attach-policy SERVER-POLICY

┌─────────────────────────────────────────────────┐
│ 路由器通告（带 SEND）                            │
├─────────────────────────────────────────────────┤
│ 标准 RA 字段                                     │
│ + CGA 参数（公钥、修饰符）                        │
│ + RSA 签名                                       │
│ + 时间戳                                         │
│ + Nonce（用于重放保护）                           │
└─────────────────────────────────────────────────┘

! 在交换机上启用 IPv6
ipv6 unicast-routing
 
! 创建 FHS 策略
ipv6 access-list ipv6-acl-fhs
 permit ipv6 any any
 
ipv6 nd inspection policy FHS-POLICY
 device-role switch
 drop-unsecure
 limit address-count 1000
 tracking enable
 
ipv6 snooping policy FHS-SNOOPING
 device-role switch
 
! 应用于 VLAN
vlan configuration 10
 ipv6 nd inspection attach-policy FHS-POLICY
 ipv6 snooping attach-policy FHS-SNOOPING
 
! 配置受信任的端口
interface GigabitEthernet1/0/49
 ipv6 nd inspection trust
 ipv6 snooping trust

# 监控 RA 频率
rdisc6 eth0
 
# 预期：每 200-600 秒来自已知路由器的 RA
# 警报：每秒多个 RA，来自未知来源的 RA

# Linux 数据包计数
ip6tables -A INPUT -p icmpv6 --icmpv6-type router-advertisement -j LOG --log-prefix "RA: "
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j LOG --log-prefix "NA: "
 
# 观察日志
journalctl -f | grep -E "RA:|NA:"

# 监控邻居表更改
watch -n 1 "ip -6 neigh show | wc -l"
 
# 高流失表示可能的投毒

# Cisco
show ipv6 nd raguard policy
show ipv6 dhcp guard policy
 
# 查找丢弃计数器递增
show platform hardware fed switch active qos queue stats internal cpu policer

index=network sourcetype=cisco:ios ipv6 "RA Guard" action=dropped
| stats count by src_ip, interface
| where count > 10

# 安装
apt-get install ndpmon
 
# 在 /etc/ndpmon/config_ndpmon.xml 中配置允许的路由器
<router>
  <mac>aa:bb:cc:dd:ee:ff</mac>
  <lla>fe80::1</lla>
</router>
 
# 开始监控
ndpmon -c /etc/ndpmon/config_ndpmon.xml

! 默认立场：所有端口都是面向主机的
ipv6 nd raguard policy DEFAULT-HOST
 device-role host
 
! 默认应用于所有端口
interface range GigabitEthernet1/0/1-48
 ipv6 nd raguard attach-policy DEFAULT-HOST
 ipv6 dhcp guard attach-policy CLIENT-POLICY
 ipv6 snooping
 
! 明确信任上行链路（使用手动覆盖）
interface GigabitEthernet1/0/49
 description Uplink to distribution
 ipv6 nd raguard attach-policy ROUTER-POLICY
 ipv6 dhcp guard attach-policy SERVER-POLICY
 ipv6 snooping trust

! 限制性较低，因为基础设施受控
! 但仍然验证来源
ipv6 nd raguard policy INFRA-POLICY
 device-role router
 match ipv6 access-list KNOWN-ROUTERS

! 访客 SSID 上的严格 RA 阻止
ipv6 nd raguard policy GUEST-POLICY
 device-role host
 no-ra

# 在所有 VM 接口上启用 RA 保护
for interface in /sys/class/net/vnet*/brport/protect_ra; do
  echo 1 > "$interface"
done

# 安装 radvd
apt-get install radvd
 
# 配置测试 RA (/etc/radvd.conf)
interface eth0 {
  AdvSendAdvert on;
  prefix 2001:db8:bad::/64 {
    AdvOnLink on;
    AdvAutonomous on;
  };
};
 
# 启动 radvd
systemctl start radvd
 
# 预期：RA Guard 阻止这些消息
# 验证：检查交换机日志以查看违规

# 发送伪造的邻居通告
ndsend eth0 2001:db8::victim -a aa:bb:cc:dd:ee:ff --na-override
 
# 预期：源防护或 ND 检查阻止
# 验证：目标上的邻居缓存未更改

# 安装
apt-get install thc-ipv6
 
# 测试 RA 泛洪
flood_router6 eth0
 
# 测试 DAD 攻击
dos-new-ip6 eth0
 
# 预期：所有攻击都被 FHS 功能阻止

from scapy.all import *
 
# 制作恶意 RA
ra = IPv6(dst="ff02::1")/ICMPv6ND_RA()/ICMPv6NDOptPrefixInfo(prefix="2001:db8:bad::")
send(ra, iface="eth0")