Simple definition
RA Guard filters unwanted IPv6 Router Advertisements on a switched network.
Technical definition
The switch applies a policy to ICMPv6 Router Advertisement messages so that only trusted ports or approved sources can advertise an IPv6 router.
What is it used for?
Prevent an unauthorized host or device from presenting itself as an IPv6 router and changing clients’ default gateway or SLAAC information.
Practical example
On a user VLAN, only uplinks toward legitimate routers are allowed to forward Router Advertisements.
Common issues
- A legitimate router-facing port is not trusted and valid RAs are blocked
- Older hardware has limited IPv6 parsing or RA Guard capabilities
- Troubleshooting is incomplete when several IPv6 security mechanisms are combined
How it works / role
The switch inspects Router Advertisements received on ports protected by RA Guard. Advertisements that match the trusted policy are forwarded, while RAs received from unauthorized ports or sources are dropped before they reach VLAN clients.
Key takeaway: Exact behavior can vary by version, product, and architecture; always validate on the environment actually deployed.