RA Guard: The Policy Nobody Attached
The policy is written, correct and completely idle. Find where it should have been applied, live, right below.
Symptom
IPv6 clients pick up a rogue default router from a user's laptop, even though an RA guard policy exists. Find where it should have been applied.
Your mission
Inspect, recover, then verify
Format
Cisco IOS CLI
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: SW1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Create a free account to open RA Guard: The Policy Nobody Attached. You get the root cause and the full step-by-step fix.
No spam. The fix lands in your inbox too. Your account includes 5 guided labs free. After that, the Learning Pass unlocks every remaining lab.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
IPv6 clients in VLAN 10 intermittently lose connectivity. Their default router list includes a link-local address belonging to a user's laptop on SW1 Gi1/0/10. The security team says RA guard was configured last month.
What you'll practice
- Explain what a rogue router advertisement does to IPv6 clients
- Read an RA guard policy and its list of targets
- Attach a host policy to access ports
- Know why the uplink toward the real router must not carry it
The topology
SW1 serves VLAN 10 hosts on Gi1/0/1 to Gi1/0/24. The legitimate IPv6 router is reached through uplink Gi1/0/48.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show ipv6 nd raguard policy HOST-PORTSshow running-config interface GigabitEthernet1/0/10Topology diagram
Fact-checked references
The commands and behaviour in this lab were checked against these primary references.
Frequently asked
Why does a laptop send router advertisements?
Usually by accident: connection sharing, a virtual machine or a misconfigured service. The effect is the same as an attack, because clients accept the advertisement and may send traffic to the laptop.
What does device-role host do?
It tells the switch that only hosts sit behind the port, so any router advertisement arriving on it is dropped. device-role router is used where a legitimate router is connected.
Can I run this on the lab's virtual switches?
Only partly. The policy commands work on the vIOS-L2 image in our PNETLab labs, but the attach-policy interface command is rejected there. This lab follows Cisco's Catalyst documentation for the attachment and its output.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.