IPv6 Neighbor Discovery (ND) inspection is a Layer 2 security feature designed to mitigate man-in-the-middle attacks that exploit the Neighbor Discovery Protocol. It operates on a switch by intercepting and validating ND messages (e.g., Neighbor Solicitations and Advertisements). The feature builds a trusted binding table, which is a Layer 2 table that maps a device's IPv6 address to its MAC address and the switch port it is connected to. This mechanism is essential for securing environments that use Stateless Address Autoconfiguration (SLAAC), where clients generate their own addresses without a central authoritative server like DHCPv6.

A. ND inspection is a Layer 2 security feature that builds its binding table on the switch, not a Layer 3 routing or neighbor table.

C. ND inspection is designed for stateless (SLAAC) address autoconfiguration. Stateful address assignment is secured by the DHCPv6 snooping feature.

D. While ND inspection is a Layer 2 feature, its primary purpose is to secure stateless (SLAAC) autoconfiguration, not stateful autoconfiguration.

1. Cisco Systems

Inc. (2023). IPv6 First-Hop Security Configuration Guide

Cisco IOS XE Cupertino 17.9.x.

Section: "Information About IPv6 First-Hop Security" > "IPv6 Neighbor Discovery Inspection"

Quote: "The IPv6 ND inspection feature learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables." This statement directly confirms that ND inspection is for stateless autoconfiguration and operates on Layer 2 neighbor tables.

2. Cisco Systems

Inc. (2022). IP Addressing: IPv6 Configuration Guide

Cisco IOS XE Gibraltar 16.12.x.

Section: "Configuring IPv6 First-Hop Security" > "IPv6 Neighbor Discovery Inspection"

Content: This section explains that ND inspection analyzes ND messages to build a secure binding table. It contrasts this with DHCPv6 snooping

which is used for stateful address assignments

reinforcing that ND inspection's role is with stateless autoconfiguration (SLAAC).