Page 222 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Duplicate Address Detection must run before assigning each unicast address, including SLAAC, DHCPv6, and manually configured addresses, except for the specified disabled and anycast cases.
Read the explainer
OSPFv3 packets use the interface’s link-local IPv6 address on ordinary interfaces, while packets on a virtual link must use a global-scope source address. Link-local addresses may appear in link-LSAs but must not be advertised in inter-area-prefix, AS-external, NSSA, or intra-area-prefix LSAs.
Read the guide
A differentiated-services domain’s boundary nodes classify and condition ingress traffic so its DS codepoints select supported per-hop behaviors.
Read the playbook
A valid Router Advertisement adds, refreshes, or immediately expires its source in the Default Router List according to the advertised Router Lifetime.
Read the briefing
During Exchange, adjacent OSPF routers describe their link-state databases; missing or newer LSAs populate the link-state request list. A router sends Link State Requests until the request list is empty, then a Loading adjacency advances to Full.
Read the checklist
Endpoint-independent UDP mapping reuses one external mapping for the same internal address and port across every external destination, and a NAT must provide that behavior.
Read the explainer
A NAT must translate a TCP RST that matches an existing mapping and should retain the associated session state for four minutes unless another packet arrives.
Read the guide
The configurable address-selection policy table supplies destination precedence and labels that favor source and destination prefixes with matching labels.
Read the playbook
The /127 recommendation applies only to point-to-point links with exactly two routers and no attached hosts; router-to-host and mixed links are outside its scope.
Read the briefing
A validating BGP speaker must determine egress origin-validation state from the effective origin AS after outbound configuration and policy have been applied.
Read the checklist