Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
Unicast RPF is supposed to prevent source addresses that differ from what they should be to be allowed. While reading Cisco's documentation for URPF, I noticed that there are options to allow it to be used on an uplink interface by letting it go by the routing-table.
My question is, if it's going by a default route wouldn't all source addresses be allowed? What benefit would URPF be doing at that point?
I'm sure I'm missing something, so I'd really like a point in the right direction.
Unicast Reverse Path Forwarding (RPF) functions in three distinct modes and can potentially help reduce a router's attack vector, specifically from spoofed IP addresses.
(config-if)#ip verify unicast source reachable-via rx
In strict mode, a router will inspect and check an incoming packet's source IP address against it's Forwarding Information Base (FIB) table for a matching route. If the route to that source IP address is reachable via the interface it was received on, the packet will be received. By default, a default route is not considered in strict mode (as configured above).
Following the configuration of Unicast RPF strict mode on a given interface, a router can no longer ping itself on that interface:
#sh ip int bri | ex unas|Int
FastEthernet0/0 11.0.11.1
#ping 11.0.11.1
.....
Success rate is 0 percent (0/5)
Verification of URPF dropped packets:
#show ip int fa0/0 | i ^ [1-9]+ verification drops
5 verification drops
#show ip traffic | i unicast
0 no route, 5 unicast RPF, 0 forced drop
This behavior can be altered by adding the allow-self-ping syntax:
(config-if)#ip verify unicast source reachable-via rx allow-self-ping
Additionally, as mentioned in your question, strict mode can allow incoming packet's source IP addresses to be checked against a default route. This is enabled by the syntax allow-default:
In strict mode, adding the syntax allow-default by itself will only prevent receipt from incoming packet's source IP address that have a route out via a different interface than received. This is assuming there are no access-lists or null routes configured on the router. All routeable source addresses that are reachable out the interface they're received will either match against specific routes or the default route.
However, if you were to employ null routes, the most specific route will be evaluated first, before the URPF check gets to the default route, and will act as a black list(s) for known malicious IP ranges.
Example - All traffic sourced from 3.0.0.0/8 will be dropped by the URPF check:
(config-if)#ip verify unicast source reachable-via rx allow-default
(config)#ip route 3.0.0.0 255.0.0.0 null 0
Bad-Source-RTR#ping 11.0.11.1 so l1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 11.0.11.1, timeout is 2 seconds:
Packet sent with a source address of 3.3.3.3
.....
Success rate is 0 percent (0/5)
Furthermore, you can specify an Access-Control List (ACL) in stead of adding the allow-default syntax to accomplish a structured list of allowed and denied addresses. Addresses that are reachable out of the interface they were received on and are matched in a defined ACL are either dropped or permitted accordingly.
!
access-list 23 permit 3.0.0.0 0.255.255.255
access-list 23 deny 4.0.0.0 0.255.255.255 log
access-list 23 permit any
!
(config)#int fa0/0
(config-if)#ip verify unicast source reachable-via rx 23
Finally, you can specify an ACL with the allow-default syntax, but it will have no effect. The packets will not be checked against ACLs specified with the allow-default option.
#ip verify unicast source reachable-via rx allow-default ?
<1-199> A standard IP access list number
<1300-2699> A standard IP expanded access list number
R1(config-if)#ip verify unicast source reachable-via any
In loose mode, a router will inspect an incoming packet's source IP address, and check it against it's FIB table for a matching route. If the route to that source IP address is reachable, the packet can be received, regardless of the interface it was received on. By default, a default route is not considered in loose mode (as configured above).
Loose mode and strict mode have similar configuration options; The main differences are the syntax that's used (any vs. rx) and whether or not the the incoming packet's source IP address is reachable via the interface it was received on.
(config-if)#ip verify unicast source reachable-via any ?
<1-199> A standard IP access list number
<1300-2699> A standard IP expanded access list number
allow-default Allow default route to match when checking source address
allow-self-ping Allow router to ping itself (opens vulnerability in
verification)
VRF mode can leverage either loose or strict mode in a given VRF and will evaluate an incoming packet's source IP address against the VRF table configured for an eBGP neighbor.
References:
Cisco URPF white paper
Understanding Unicast Reverse Path Forwarding
URPF configuration guide
