Chapter 21
IPv6 URPF Configuration
Table of Contents
21.1 URPF Overview
URPF Introduction
Unicast Reverse Path Forwarding (
) can prevent the network attack behavior that is
based on source address spoofing.
By checking the source IP addresses contained in packets, URPF decides whether traffic
is valid and whether to forward or drop the packets according to the interface on which
packets are received and whether the routes of the source addresses exist in the routing
table.
URPF is divided into three kinds.
l
sRPF: strict URPF
l
lRPF: loose URPF
l
lnRPF: URPF ignoring default route
Strict RPF
Strict RPF is an easier method to filter source address. It performs routing lookup by source
address and estimates whether the egress interface of return path is consistent with the
ingress interface of the packets arriving. If they are consistent, the forwarding continues.
If they are inconsistent, URPF ACL matching is considered. If URPF ACL matching is not
performed, then the packets are discarded directly. Conversely, if URPF ACL matching is
performed and the result is matched, the forwarding continues. If the result is not matched,
the packets are discarded.
Strict RPF is only applicable to route symmetry. That is, when the packets enter from
a direction, its entrance path is the same with its return path. However, the route paths
normally are asymmetric between ISPs. At the same time, if some BGP valid network
segment addresses are not advertised or accepted by ISP policy, sRPF just like an ACL
with incomplete configuration. Some valid data flow will be discarded because of lack of
information in the forwarding table of the filter router.
21-1
SJ-20140504150128-018|2014-05-10 (R1.0)
ZTE Proprietary and Confidential
