What is unicast reverse path forwarding, and when do you use strict versus loose mode?
Show the answer
Say this first
uRPF drops packets whose source address fails a routing check, which stops spoofed traffic. Strict mode requires that the best route back to the source points out the same interface the packet arrived on. Loose mode only requires that some route to the source exists in the FIB, through any interface, and a route to Null0 counts as a failure. Strict fits single-homed edges, like customer or access links, where routing is symmetric. Loose fits multihomed and transit links, where asymmetric routing is normal, mainly to drop unroutable sources and to support source-based blackholing.
Go deeper
Configuration on IOS
interface GigabitEthernet0/0/1
description Customer A, single-homed
ip verify unicast source reachable-via rx
!
interface GigabitEthernet0/0/0
description ISP1 transit
ip verify unicast source reachable-via anyuRPF needs CEF. By default the default route does not count as a valid path; allow-default changes
that. IPv6 uses ipv6 verify unicast source reachable-via rx.
Why strict breaks multihoming
With two ISPs, traffic from a given source can arrive on ISP2 while your best route back to that source is through ISP1. Strict mode drops it. Loose mode accepts it as long as any route exists.
Source-based RTBH
During an attack from known sources, a BGP trigger installs routes for those sources pointing to Null0 on every edge router. Loose uRPF then drops packets from those sources, because their only route is Null0. The same trick that blackholes destinations can blackhole sources.
Other platforms
Junos uses rpf-check on the logical interface (strict by default, mode loose available). Linux
has net.ipv4.conf.<if>.rp_filter: 1 is strict, 2 is loose.
They will ask next
How do you see uRPF drops on IOS?
show ip interface Gi0/0/1lists the uRPF mode and a count of verification drops, andshow ip traffichas a total for unicast RPF drops.Where else does uRPF logic appear?
Multicast routing uses the same RPF check on every packet to prevent loops, and Linux applies rp_filter to every interface, which surprises people running asymmetric routing on servers.
Traps
- Enabling strict uRPF on a transit or multihomed link and blackholing legitimate traffic.