On a Tuesday afternoon, a regional hospital’s network team finished enabling RA Guard on every access switch. The change closed a finding from the last audit. Two nights later, a workstation on the clinical VLAN began resolving the EHR gateway to a wrong next hop. Packet captures showed legitimate Router Advertisements and forged Neighbor Advertisements claiming ownership of the gateway’s link-local and global addresses. RA Guard did its job. Neighbor Discovery still lied.
That pattern keeps showing up in dual-stack campuses where IPv6 was “turned on for readiness” years ago and then secured with a single control. ISC Stormcast for September 17–18, 2026 continues to remind operators that attackers chain small protocol gaps into usable access. On the same news cycle, coverage of post-exploitation identity misuse in SPIFFE/SPIRE and AI agent incidents that rewrite personal data underline a related operational truth: cryptographic workload identity does not stop an on-link IPv6 man-in-the-middle from observing or redirecting traffic before those higher-layer checks ever run.
What actually failed on that VLAN
IPv6 first-hop behavior depends on Neighbor Discovery Protocol (NDP). Hosts learn gateways from Router Advertisements. They resolve on-link neighbors with Neighbor Solicitations and Neighbor Advertisements. RA Guard filters which ports may send RAs. It does not validate who may answer “who has this address?” on the same segment.
In the hospital case, the attacker already had a foothold on a printer VLAN that shared L2 with clinical machines through a mis-scoped trunk. From there they:
- Sent unsolicited Neighbor Advertisements for the default gateway’s addresses with the Override flag set
- Refreshed the poison faster than honest NUD (Neighbor Unreachability Detection) could heal it
- Forwarded intercepted traffic so sessions stayed up long enough to harvest credentials and session tokens
From the SOC’s view, flows still showed the correct gateway IP. MAC tables and ND caches told a different story. IPv4 ARP inspection was mature. IPv6 ND inspection was never enabled because the team treated RA Guard as full first-hop coverage.
Build a first-hop IPv6 control set that matches how NDP works
Treat NDP the way mature shops treat ARP: assume hosts will believe the last convincing answer unless the switch validates bindings.
1. Pair RA Guard with Dynamic IPv6 ND Inspection
On access switches that support it, enable IPv6 ND inspection (Cisco DAI-for-IPv6 style features, Juniper equivalent ND inspection, or vendor “IPv6 source guard / ND snooping” bundles). The working model is:
- Learn legitimate address-to-MAC-to-port bindings from DHCPv6 snooping, SLAAC monitoring, or static entries for infrastructure
- Drop Neighbor Advertisements and Solicitations that claim addresses outside the learned binding for that port
- Rate-limit ND floods so a single host cannot exhaust the neighbor cache on the first-hop router
Start in monitoring or “log only” mode for one or two VLANs. Expect noise from printers, medical devices, and older IoT stacks that send odd ND options. Fix the bindings before you flip to enforce.
2. Scope DHCPv6 snooping and static infrastructure entries early
If you run SLAAC-only access networks, ND inspection has less authoritative state to learn from. Many teams solve this by:
- Using DHCPv6 for address assignment on staff and server VLANs where inventory accuracy matters
- Keeping SLAAC for guest or tightly isolated segments with stricter ND rate limits
- Pinning static ND/IP-MAC bindings for routers, firewalls, jump hosts, and DNS resolvers
Tradeoff: DHCPv6 improves binding quality and forensics; SLAAC reduces DHCP operational load. Mixing both without documenting which VLANs use which model creates enforcement holes.
3. Turn on IPv6 Source Guard where hardware supports it
Source Guard (or IP verify source for IPv6) stops a host from sourcing packets with addresses it does not own, even when ND messages look clean. Use it on user access ports. Leave it off trunk ports and carefully documented infrastructure uplinks until you have verified ASIC support and TCAM headroom.
4. Cap Neighbor Cache pressure on routers and firewalls
NDP cache exhaustion remains a practical DoS against first-hop devices. Configure per-interface neighbor cache limits, ND rate limiting, and alerting when cache utilization climbs toward the ceiling. An empty neighbor cache during a busy shift looks like random reachability flaps and wastes hours before anyone blames IPv6.
Validate the control with traffic you already understand
Do not wait for another incident to prove coverage. Run a controlled exercise on a lab or canary VLAN:
- From a test host, send a forged Neighbor Advertisement for the gateway address
- Confirm the switch drops or logs it under ND inspection
- Confirm RA Guard still blocks a rogue RA from the same port
- Confirm honest failover still works when you shut the primary gateway and the backup legitimately advertises
Capture both success and failure paths. Store the packet examples next to the change ticket so the next on-call engineer knows what “good” and “bad” look like.
Where monitoring must catch what policy misses
Not every platform supports full ND inspection. Branch offices, unmanaged medical switches, and cloud virtual networks often leave you with telemetry only. Prioritize these signals:
- Multiple MACs claiming the same IPv6 address within a short window
- Sudden ND cache churn for gateway or DNS addresses
- Hosts whose default route next-hop MAC differs from the known gateway chassis MAC
- Outbound dual-stack sessions where IPv6 destinations diverge from the IPv4 path for the same application
Wire those into the same identity context you already use for account takeovers. Recent reporting on SPIFFE/SPIRE identity misuse and AI agents that alter personal data is a reminder that once traffic is redirected on-link, session tokens and agent API keys become fair game. Network-level ND integrity is part of that identity story, not a separate “IPv6 project.”
Operational caveats teams hit in production
Silent permit on empty IPv6 ACLs. Several firewall vendors still ship IPv6 policy objects that default more permissively than their IPv4 twins. After you harden NDP on the LAN, audit edge and segmentation policies for empty or any-any IPv6 rulebases. NDP spoofing gets attackers onto the path; empty IPv6 ACLs keep them useful.
Link-local traffic is required. Overblocking ICMPv6 breaks Path MTU Discovery, NDP, and multicast listener behavior. Allow the ICMPv6 types your platform documentation requires for on-link operation, then restrict the rest deliberately. Blind “block all ICMP” copied from old IPv4 playbooks creates mysterious outages that push operators to disable IPv6 controls entirely.
Wireless controllers and IoT switches. RA Guard may exist while ND inspection does not. Document the gap and compensate with tighter VLAN isolation, shorter lease or preferred lifetimes, and host-based detection on high-value endpoints.
Cloud overlays. In VPC/VNet designs, hypervisors often own neighbor resolution. Your job shifts to security group parity, route table review, and verifying that dual-stack instances do not expose management listeners only on IPv6.
A 30-day remediation sequence that fits real change windows
- Inventory which access layers advertise IPv6 today and which already run RA Guard
- Pick one staff VLAN and one server VLAN as pilots for ND inspection in monitor mode
- Export binding tables daily and reconcile against DHCP/SLAAC and CMDB ownership
- Add static bindings for gateways and resolvers before enforce mode
- Enable ND rate limits and neighbor cache alerts on first-hop routers
- Diff IPv4 vs IPv6 firewall objects for the same zones; close empty IPv6 gaps
- Add ND MAC conflict detections to the SOC runbook next to ARP spoof playbooks
- Expand enforce mode VLAN by VLAN after each pilot clears a full change cycle
What to take into the next change window
RA Guard is necessary and incomplete. Local IPv6 MITM usually arrives as Neighbor Advertisement spoofing, cache exhaustion, or an empty IPv6 policy sitting beside a mature IPv4 deny set. Pair discovery inspection with source validation, keep ICMPv6 narrowly allowed, and correlate ND anomalies with identity events so a redirected session surfaces before an agent, script, or human operator abuses the path.
If your campus already closed rogue Router Advertisements, schedule the ND inspection pilot next. That is the control that matches the failure mode most teams still leave open.
