10

Unicast RPF is supposed to prevent source addresses that differ from what they should be to be allowed. While reading Cisco's documentation for URPF, I noticed that there are options to allow it to be used on an uplink interface by letting it go by the routing-table.

My question is, if it's going by a default route wouldn't all source addresses be allowed? What benefit would URPF be doing at that point?

I'm sure I'm missing something, so I'd really like a point in the right direction.

1 Answer 1

15

Unicast Reverse Path Forwarding (RPF) functions in three distinct modes and can potentially help reduce a router's attack vector, specifically from spoofed IP addresses.

Strict Mode

(config-if)#ip verify unicast source reachable-via rx

In strict mode, a router will inspect and check an incoming packet's source IP address against it's Forwarding Information Base (FIB) table for a matching route. If the route to that source IP address is reachable via the interface it was received on, the packet will be received. By default, a default route is not considered in strict mode (as configured above).

Strict Mode Options:

Following the configuration of Unicast RPF strict mode on a given interface, a router can no longer ping itself on that interface:

#sh ip int bri | ex unas|Int
FastEthernet0/0            11.0.11.1

#ping 11.0.11.1                                    
.....
Success rate is 0 percent (0/5)

Verification of URPF dropped packets:

#show ip int fa0/0 | i ^  [1-9]+ verification drops
     5 verification drops
#show ip traffic | i unicast
     0 no route, 5 unicast RPF, 0 forced drop

This behavior can be altered by adding the allow-self-ping syntax:

(config-if)#ip verify unicast source reachable-via rx allow-self-ping

Additionally, as mentioned in your question, strict mode can allow incoming packet's source IP addresses to be checked against a default route. This is enabled by the syntax allow-default:

In strict mode, adding the syntax allow-default by itself will only prevent receipt from incoming packet's source IP address that have a route out via a different interface than received. This is assuming there are no access-lists or null routes configured on the router. All routeable source addresses that are reachable out the interface they're received will either match against specific routes or the default route.

However, if you were to employ null routes, the most specific route will be evaluated first, before the URPF check gets to the default route, and will act as a black list(s) for known malicious IP ranges.

Example - All traffic sourced from 3.0.0.0/8 will be dropped by the URPF check:

(config-if)#ip verify unicast source reachable-via rx allow-default
(config)#ip route 3.0.0.0 255.0.0.0 null 0

Bad-Source-RTR#ping 11.0.11.1 so l1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 11.0.11.1, timeout is 2 seconds:
Packet sent with a source address of 3.3.3.3 
.....
Success rate is 0 percent (0/5)

Furthermore, you can specify an Access-Control List (ACL) in stead of adding the allow-default syntax to accomplish a structured list of allowed and denied addresses. Addresses that are reachable out of the interface they were received on and are matched in a defined ACL are either dropped or permitted accordingly.

!
access-list 23 permit 3.0.0.0 0.255.255.255
access-list 23 deny   4.0.0.0 0.255.255.255 log
access-list 23 permit any
!
(config)#int fa0/0                                 
(config-if)#ip verify unicast source reachable-via rx 23

Finally, you can specify an ACL with the allow-default syntax, but it will have no effect. The packets will not be checked against ACLs specified with the allow-default option.

#ip verify unicast source reachable-via rx allow-default ? 
  <1-199>          A standard IP access list number
  <1300-2699>      A standard IP expanded access list number

Loose Mode

R1(config-if)#ip verify unicast source reachable-via any

In loose mode, a router will inspect an incoming packet's source IP address, and check it against it's FIB table for a matching route. If the route to that source IP address is reachable, the packet can be received, regardless of the interface it was received on. By default, a default route is not considered in loose mode (as configured above).

Loose mode and strict mode have similar configuration options; The main differences are the syntax that's used (any vs. rx) and whether or not the the incoming packet's source IP address is reachable via the interface it was received on.

(config-if)#ip verify unicast source reachable-via any ?
  <1-199>          A standard IP access list number
  <1300-2699>      A standard IP expanded access list number
  allow-default    Allow default route to match when checking source address
  allow-self-ping  Allow router to ping itself (opens vulnerability in
                   verification)

VRF Mode

VRF mode can leverage either loose or strict mode in a given VRF and will evaluate an incoming packet's source IP address against the VRF table configured for an eBGP neighbor.


References:
Cisco URPF white paper
Understanding Unicast Reverse Path Forwarding
URPF configuration guide

4
  • What about the practical application? Does it really even make sense/a difference to put it on your uplink?
    – coxley
    Sep 7, 2013 at 6:29
  • 3
    @codey I would not run uRPF at uplink, only at customer facing interfaces. one.time, +1, good work, solid answers, I'd like to point out that static route to null0 in some non-cisco platforms won't cause 'loose' mode to fail. Maybe instead of 'replied' you should use 'receive', i.e. packets failed RPF won't be received. Also maybe 'against routing-table' (RIB) should be changed to 'against forwarding-table' (FIB). Since there is flavor of uRPF called 'feasible loose/strict', which checks against RIB (Cisco does not support it, they check against FIB only).
    – ytti
    Sep 7, 2013 at 6:40
  • @ytti When I looked at Cisco docs, it simply said against the routing table. I'm not saying that's correct, but weird that they'd say that if it was just the FIB.
    – coxley
    Sep 7, 2013 at 6:52
  • Imagine case where customer announced BGP prefix 192.0.2.0/24, you also have static route for this pointing to core. If customer interface has uRPF/strict, you'll drop packets from customer having source address 192.0.2.42, even though in RIB (routing-table) this entry exists, it's just not /best/ entry, and consequently it's not in FIB. However if you run 'uRPF/strict feasible' packet won't be dropped (JunOS supports feasible, so its documents will give additional information).
    – ytti
    Sep 7, 2013 at 6:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.