Based on this documentation: https://www.cisco.com/c/en/us/td/docs/iosxr/ncs5500/security/62x/b-system-security-cg-ncs5500-62x/b-system-security-cg-ncs5500-62x_chapter_01001.html I'm trying to set up the URPF (strict) in an interface. The router itself has an IOS XE 7.1.1 up and running.
I have disabled ipv4 and ipv6 scaling, as the documentation described:
configure
hw-module tcam fib ipv4 scaledisable
hw-module fib ipv6 scale internet-optimized-disable
commit
And reloaded the router:
reload
The interface where I'm trying to set the URPF has a default configuration, except the IPv4 and IPv6 addresses:
interface TenGigE0/0/0/0
ipv4 address 22.33.44.55 255.255.255.0
ipv6 address 2001::1/64
shutdown
After trying to apply the URPF for IPv4, I get this error:
RP/0/RP0/CPU0:Router(config-if)#interface TenGigE0/0/0/0
RP/0/RP0/CPU0:Router(config-if)#ipv4 verify unicast source reachable-via rx
RP/0/RP0/CPU0:Router(config-if)#commit
Tue Oct 13 12:33:44.099 UTC
% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed [inheritance]' from this session to view the errors
RP/0/RP0/CPU0:Router(config-if)#show configuration failed
...
interface TenGigE0/0/0/0
ipv4 verify unicast source reachable-via rx
!!% The process 'ipv4_ma' rejected the operation but returned no error
!
end
After trying to apply the URPF for both IPv4 and IPv6, I get this error:
RP/0/RP0/CPU0:Router(config)#interface TenGigE0/0/0/0
RP/0/RP0/CPU0:Router(config-if)#ipv4 verify unicast source reachable-via rx
RP/0/RP0/CPU0:Router(config-if)#ipv6 verify unicast source reachable-via rx
RP/0/RP0/CPU0:Router(config-if)#commit
Tue Oct 13 12:36:06.613 UTC
% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed [inheritance]' from this session to view the errors
RP/0/RP0/CPU0:Router(config-if)#show configuration failed
Tue Oct 13 12:36:12.301 UTC
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.
interface TenGigE0/0/0/0
ipv4 verify unicast source reachable-via rx
!!% 'ipv4-ma' detected the 'warning' condition 'Platform doesn't support strict RPF on this card'
ipv6 verify unicast source reachable-via rx
!!% 'ipv6-ma' detected the 'warning' condition 'Platform doesn't support loose RPF on this card'
!
end
The interesting part is that I try the strict (rx) configuration for both IPv4 and IPv6, but the error message told me the platform doesn't support loose (any) rpf for IPv6. BTW I don't see any restrictions in the platform for the URPF configuration in the documentation, so I think it is supported. I didn't found any documentation which told me it isn't.
