1

Based on this documentation: https://www.cisco.com/c/en/us/td/docs/iosxr/ncs5500/security/62x/b-system-security-cg-ncs5500-62x/b-system-security-cg-ncs5500-62x_chapter_01001.html I'm trying to set up the URPF (strict) in an interface. The router itself has an IOS XE 7.1.1 up and running.

I have disabled ipv4 and ipv6 scaling, as the documentation described:

configure
hw-module tcam fib ipv4 scaledisable
hw-module fib ipv6 scale internet-optimized-disable
commit

And reloaded the router:

reload

The interface where I'm trying to set the URPF has a default configuration, except the IPv4 and IPv6 addresses:

interface TenGigE0/0/0/0
 ipv4 address 22.33.44.55 255.255.255.0
 ipv6 address 2001::1/64
 shutdown

After trying to apply the URPF for IPv4, I get this error:

RP/0/RP0/CPU0:Router(config-if)#interface TenGigE0/0/0/0
RP/0/RP0/CPU0:Router(config-if)#ipv4 verify unicast source reachable-via rx
RP/0/RP0/CPU0:Router(config-if)#commit
Tue Oct 13 12:33:44.099 UTC

% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed [inheritance]' from this session to view the errors
RP/0/RP0/CPU0:Router(config-if)#show configuration failed
...

interface TenGigE0/0/0/0
 ipv4 verify unicast source reachable-via rx
!!% The process 'ipv4_ma' rejected the operation but returned no error
!
end

After trying to apply the URPF for both IPv4 and IPv6, I get this error:

RP/0/RP0/CPU0:Router(config)#interface TenGigE0/0/0/0
RP/0/RP0/CPU0:Router(config-if)#ipv4 verify unicast source reachable-via rx
RP/0/RP0/CPU0:Router(config-if)#ipv6 verify unicast source reachable-via rx
RP/0/RP0/CPU0:Router(config-if)#commit
Tue Oct 13 12:36:06.613 UTC

% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed [inheritance]' from this session to view the errors
RP/0/RP0/CPU0:Router(config-if)#show configuration failed
Tue Oct 13 12:36:12.301 UTC
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.


interface TenGigE0/0/0/0
 ipv4 verify unicast source reachable-via rx
!!% 'ipv4-ma' detected the 'warning' condition 'Platform doesn't support strict RPF on this card'
 ipv6 verify unicast source reachable-via rx
!!% 'ipv6-ma' detected the 'warning' condition 'Platform doesn't support loose RPF on this card'
!
end

The interesting part is that I try the strict (rx) configuration for both IPv4 and IPv6, but the error message told me the platform doesn't support loose (any) rpf for IPv6. BTW I don't see any restrictions in the platform for the URPF configuration in the documentation, so I think it is supported. I didn't found any documentation which told me it isn't.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.