No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

Configuration Guide - Security

CloudEngine 8800, 7800, 6800, and 5800 V200R005C10

This document describes the configurations of Security, including ACL, local attack defense, MFF, attack defense, traffic suppression and storm control, ARP security, Port security, DHCP snooping, ND snooping, PPPoE+, IPSG, SAVI, separating the management plane from the service plane, security risks.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Configuring the URPF Check Mode

Configuring the URPF Check Mode

Context

In a complicated networking environment, On a complex network, asymmetric routes may exist. That is, the routes recorded on the local end and remote end are different. A URPF-enabled device on this network may discard the packets transmitted along the correct path, but forward the invalid packets.

The device provides the following URPF modes to solve the preceding problem:

  • Strict check

    In strict mode, a packet can pass the check only when the source IP address of the packet exists in the Forwarding Information Base (FIB) table and the related entries and interfaces match.

    If route symmetry is ensured, you are advised to use the URPF strict check. For example, if there is only one path between two network edge devices, URPF strict check can be used to ensure network security.

NOTE:

You are advised to enable URPF before services are deployed. If you need to enable URPF after services are deployed, you can configure when less traffic is transmitted and ensure that the FIB table reduced by a half can meet network requirements.

Procedure

  1. Run system-view

    The system view is displayed.

  2. Configuring the URPF Check Mode (CE6870EI and CE6875EI):

    Run ip urpf { loose | strict | allow-default-route }

    The global URPF check mode is configured.

    By default, URPF check is not globally enabled. If URPF check is enabled on the interface, URPF check is in loose mode.

  3. Configuring the URPF Check Mode (except CE6870EI and CE6875EI):
    1. Run interface interface-type interface-number

      The interface view is displayed.

    2. On an Ethernet interface, run undo portswitch (Perform this step on the CE5880EI and CE6880EI only.)

      The interface is switched to Layer 3 mode.

      By default, an Ethernet interface works in Layer 2 mode.

      If an Ethernet interface already has Layer 2 configuration, this command fails to be executed on the interface. Before running this command on the interface, delete all the Layer 2 configuration of the interface.

      NOTE:

      If many Ethernet interfaces need to be switched to Layer 3 mode, run the undo portswitch batch interface-type { interface-number1 [ to interface-number2 ] } &<1-10> command in the system view to switch these interfaces to Layer 3 mode in batches.

    3. Run ip urpf { loose | strict | allow-default-route }

      The URPF check mode is configured on the interface.

      By default, URPF check mode is not enabled. If URPF check is enabled on the interface, URPF check is in loose mode.

  4. Run commit

    The configuration is committed.

Translation
Download
Updated: 2019-04-20

Document ID: EDOC1100074765

Views: 23302

Downloads: 93

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next