No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

CLI-based Configuration Guide - Security

AR100, AR120, AR150, AR160, AR200, AR1200, AR2200, AR3200, and AR3600 V200R010

This document provides the basic concepts, configuration procedures, and configuration examples in different application scenarios of the network management feature supported by the device.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Understanding URPF

Understanding URPF

Working Mode

On a complex network, the routes recorded on the local end and remote end may be different. A URPF-enabled device on this network may discard the packets transmitted along the correct path, but forward the invalid packets.

The device provides the following URPF modes to solve the preceding problem:

  • Strict check

    In strict mode, a packet passes the check only when the source IP address of the packet exists in the FIB table and the interface of the default route matches the inbound interface of the packet.

    If route symmetry is ensured, you are advised to use the URPF strict check. For example, if there is only one path between two network edge devices, URPF strict check can be used to ensure network security.

  • Loose check

    In loose mode, a packet passes the check as long as the source IP address of the packet matches an entry in the FIB table.

    If route symmetry is not ensured, you are advised to use the URPF loose check. For example, if there are multiple paths between two network edge devices, URPF loose check can be used to ensure network security.

Working Mechanism

URPF enables the device to search for the source IP address of a received packet in the FIB table to obtain the matching inbound interface. If this inbound interface is different from the inbound interface of the packet, the device considers the source address as a spoofing one and discards the packet. In this manner, URPF can effectively protect the device against malicious attacks by modifying source IP addresses in packets.

Figure 15-1  URPF working mechanism

As shown in Figure 15-1, a bogus packet with source IP address 2.1.1.1 is sent from RouterA to RouterB. After receiving the bogus packet, RouterB sends a response packet to the actual destination device RouterC at 2.1.1.1. RouterB and RouterC are attacked by the bogus packets.

When RouterB with URPF strict check enabled receives the bogus packet with source IP address 2.1.1.1, URPF discards the packet because the inbound interface of the source IP address is not the interface that receives the packet.

Translation
Download
Updated: 2019-08-07

Document ID: EDOC1100034077

Views: 137539

Downloads: 248

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next