>
    Strata Copilot
    Enable NDP Monitoring
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Configure Interfaces
    4. Layer 3 Interfaces
    5. Enable NDP Monitoring
    Download PDF
    Next-Generation Firewall

    Enable NDP Monitoring

    Table of Contents

    Enable NDP Monitoring

    NDP uses ICMPv6 packets to discover and track the link-layer addresses and status of neighbors on connected links.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by PAN-OS or Panorama)
    Neighbor Discovery Protocol (NDP) for IPv6 (RFC 4861) performs functions similar to ARP functions for IPv4. The firewall by default runs NDP, which uses ICMPv6 packets to discover and track the link-layer addresses and status of neighbors on connected links.
    Use NDP to monitor IPv6 addresses, which allows you to quickly track the IPv6 address and MAC address of a device and the associated user who has violated a security rule. Enable NDP monitoring to view the IPv6 addresses of devices on the link local network, their MAC address, associated username from User-ID (if the user of that device used the directory service to log in), reachability Status of the address, and Last Reported date and time the NDP monitor received a Router Advertisement from this IPv6 address. The username is on a best-case basis; there can be many IPv6 devices on a network with no username, such as printers, fax machines, servers, etc.
    If you want to quickly track a device and user who has violated a security rule, it is very useful to have the IPv6 address, MAC address and username displayed all in one place. You need the MAC address that corresponds to the IPv6 address in order to trace the MAC address back to a physical switch or Access Point.
    NDP monitoring is not guaranteed to discover all devices because there could be other networking devices between the firewall and the client that filter out NDP or Duplicate Address Detection (DAD) messages. The firewall can monitor only the devices that it learns about on the interface.
    NDP monitoring also monitors Duplicate Address Detection (DAD) packets from clients and neighbors. You can also monitor IPv6 ND logs to make troubleshooting easier.
    NDP monitoring is supported for Ethernet interfaces, subinterfaces, Aggregated Ethernet interfaces, and VLAN interfaces on all PAN-OS models.
    Perform this task to enable NDP monitoring for an interface.
    1. Enable NDP monitoring.
      1. Select NetworkInterfaces and Ethernet or VLAN.
      2. Select the interface you are configuring.
      3. Select IPv6.
      4. Select Address Resolution.
      5. Select Enable NDP Monitoring.
        After you enable or disable NDP monitoring, you must Commit before NDP monitoring can start or stop.
      6. Click OK.
    2. Commit your changes.
    3. Monitor NDP and DAD packets from clients and neighbors.
      1. Select NetworkInterfaces and Ethernet or VLAN.
      2. For the interface where you enabled NDP monitoring, in the Features column, hover over the NDP Monitoring
        icon:
        The NDP Monitoring summary for the interface displays the list of IPv6 Prefixes that this interface will send in the Router Advertisement (RA) if RA is enabled (they are the IPv6 prefixes of the interface itself).
        The summary also indicates whether DAD, Router Advertisement, and DNS Support are enabled; IP addresses of any Recursive DNS Servers configured; and any DNS suffixes configured on the DNS Search List.
      3. Click on the NDP Monitoring icon to display detailed information.
        Each row of the detailed NDP Monitoring table for the interface displays the IPv6 address of a neighbor the firewall has discovered, the corresponding MAC address, corresponding User ID (on a best-case basis), reachability Status of the address, and Last Reported date and time this NDP Monitor received an RA from this IP address. A User ID will not display for printers or other non-user-based hosts. If the status of the IP address is Stale, the neighbor is not known to be reachable, per RFC 4861.
        At the bottom right is the count of Total Devices Detected on the link local network.
        • Enter an IPv6 address in the filter field to search for an address to display.
        • Select the check boxes to display or not display IPv6 addresses.
        • Click the numbers, the right or left arrow, or the vertical scroll bar to advance through many entries.
        • Click Clear All NDP Entries to clear the entire table.
    4. Monitor ND logs for reporting purposes.
      1. Select MonitorLogsSystem.
      2. In the Type column, view ipv6nd logs and corresponding descriptions.
        For example, inconsistent router advertisementreceived indicates that the firewall received an RA different from the RA that it is going to send out.

    © 2026 Palo Alto Networks, Inc. All rights reserved.