Securing IPv6: Harden and Monitor IPv6 Networks

Lifetime course access · you build the lab on your own VM

About Course

Find the IPv6 traffic already running on your network, then harden, filter and monitor it so it stops being a blind spot.

What you’ll do

Discover IPv6 hosts and traffic you didn't know you had
Harden hosts and filter IPv6 at the edge
Detect IPv6-specific attacks in your monitoring tools
Build an IPv6 security checklist for your network

Part of the SOC Analyst track, aligned with DoD 8140 work role 511 Cyber Defense Analyst.

Taught by practitioners who do this work every day. Finish the course to earn a certificate with CPE hours.

Course Content

Defensive Posture & IPv6 Orientation
Est. 25 min · 3 lessons · establish the baseline and what "good" looks like before you change anything

Lesson 0.1 — Know Your IPv6 Attack Surface Before You Defend It
Lesson 0.2 — The Defender’s Lab Topology
Lesson 0.3 — IPv6 Defender’s Quick Reference

Visibility & Monitoring: See the Segment You Defend
Est. 45 min · 4 lessons + lab · you cannot defend what you cannot see

NDP Defense: Fix IPv6’s ARP Problem
Est. 55 min · concept + 3 lessons + lab · answer parasite6, redir6, and fake_mld6

Extension Headers & Firewall Parity: Close the Bypass
Est. 40 min · concept + 3 lessons + lab · answer firewall6, implementation6, and frag6

RA Guard & Rogue-Router Defense: Take Back the Gateway
Est. 55 min · concept + 3 lessons + lab · answer fake_router6 and fake_dhcps6/fake_dns6

Transition Mechanism Control: Close the Back Doors
Est. 30 min · concept + 2 lessons + lab · answer 6to4/Teredo/ISATAP abuse

The Full Defensive Posture: Detect, Alert, and Break the Chain
Est. 30 min · 1 walkthrough + capstone framing · every control, as one monitored posture

Graded Capstone & Final Knowledge Check

Your Next Step: Incident Response
Est. 10 min · 1 lesson · what you carry forward, and where it goes next

Student Ratings & Reviews

No Review Yet

About Course

What you’ll do

Course Content

Defensive Posture & IPv6 Orientation <p><em>Est. 25 min · 3 lessons · establish the baseline and what "good" looks like before you change anything</em></p>

Lesson 0.1 — Know Your IPv6 Attack Surface Before You Defend It

Lesson 0.2 — The Defender’s Lab Topology

Lesson 0.3 — IPv6 Defender’s Quick Reference

Visibility & Monitoring: See the Segment You Defend <p><em>Est. 45 min · 4 lessons + lab · you cannot defend what you cannot see</em></p>

Lesson 1.1 — Baseline the Segment: Know Normal Before You Chase Abnormal

Lesson 1.2 — Watch NDP on the Wire: The Defender’s tcpdump

Lesson 1.3 — Continuous NDP Monitoring with addrwatch/ndpmon

Lesson 1.4 — Module 1 Lab: Build the Baseline and Prove You Can See an Attack

NDP Defense: Fix IPv6’s ARP Problem <p><em>Est. 55 min · concept + 3 lessons + lab · answer parasite6, redir6, and fake_mld6</em></p>

Lesson 2.0 — Concept: Authenticating and Constraining Neighbor Discovery

Lesson 2.1 — Defeat Neighbor-Cache Poisoning: Static Neighbors, RA-Managed Trust, and Detection

Lesson 2.2 — Defeat ICMPv6 Redirect Hijacking: Refuse Redirects

Lesson 2.3 — Defeat MLD Flooding: MLD Snooping with Limits

Lesson 2.4 — Module 2 Lab: Harden a Host Against the NDP Attack Set

Extension Headers & Firewall Parity: Close the Bypass <p><em>Est. 40 min · concept + 3 lessons + lab · answer firewall6, implementation6, and frag6</em></p>

Lesson 3.0 — Concept: Why IPv6 Firewalls Leak, and the Parity Principle

Lesson 3.1 — Build IPv6 Firewall Parity: Default-Deny with ip6tables/nftables

Lesson 3.2 — Filter and Normalize Extension Headers and Fragments

Lesson 3.3 — Module 3 Lab: Prove IPv6 Firewall Parity

RA Guard & Rogue-Router Defense: Take Back the Gateway <p><em>Est. 55 min · concept + 3 lessons + lab · answer fake_router6 and fake_dhcps6/fake_dns6</em></p>

Lesson 4.0 — Concept: Deciding Who Is Allowed to Be the Router

Lesson 4.1 — RA Guard on the Fabric: Only the Router Port May Advertise

Lesson 4.2 — DHCPv6 Guard and Host RA Policy: Close Rogue DHCPv6/DNS

Lesson 4.3 — Module 4 Lab: Defend the Gateway and the Map

Transition Mechanism Control: Close the Back Doors <p><em>Est. 30 min · concept + 2 lessons + lab · answer 6to4/Teredo/ISATAP abuse</em></p>

Lesson 5.0 — Concept: The IPv6 You Did Not Know You Were Running

Lesson 5.1 — Disable and Filter Transition Mechanisms

Lesson 5.2 — Module 5 Lab: Close and Detect the Transition Back Doors

The Full Defensive Posture: Detect, Alert, and Break the Chain <p><em>Est. 30 min · 1 walkthrough + capstone framing · every control, as one monitored posture</em></p>

Lesson 6.1 — The Full Defensive Posture: Break the Chain at Every Link

Graded Capstone & Final Knowledge Check

Lab 7 — Capstone: Practical Defensive Assessment

Final Knowledge Check

Lesson 7.2 — Supplemental Materials & Community Shout-Outs

Your Next Step: Incident Response <p><em>Est. 10 min · 1 lesson · what you carry forward, and where it goes next</em></p>

Lesson 8.1 — What Changes Next: Incident Response

Student Ratings & Reviews

Academy

Services

Latest from the blog

Careers & Partners

Legal

Defensive Posture & IPv6 Orientation
<p><em>Est. 25 min · 3 lessons · establish the baseline and what "good" looks like before you change anything</em></p>

Visibility & Monitoring: See the Segment You Defend
<p><em>Est. 45 min · 4 lessons + lab · you cannot defend what you cannot see</em></p>

NDP Defense: Fix IPv6’s ARP Problem
<p><em>Est. 55 min · concept + 3 lessons + lab · answer parasite6, redir6, and fake_mld6</em></p>

Extension Headers & Firewall Parity: Close the Bypass
<p><em>Est. 40 min · concept + 3 lessons + lab · answer firewall6, implementation6, and frag6</em></p>

RA Guard & Rogue-Router Defense: Take Back the Gateway
<p><em>Est. 55 min · concept + 3 lessons + lab · answer fake_router6 and fake_dhcps6/fake_dns6</em></p>

Transition Mechanism Control: Close the Back Doors
<p><em>Est. 30 min · concept + 2 lessons + lab · answer 6to4/Teredo/ISATAP abuse</em></p>

The Full Defensive Posture: Detect, Alert, and Break the Chain
<p><em>Est. 30 min · 1 walkthrough + capstone framing · every control, as one monitored posture</em></p>

Your Next Step: Incident Response
<p><em>Est. 10 min · 1 lesson · what you carry forward, and where it goes next</em></p>