No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

Configuration Guide - Security

CloudEngine 8800, 7800, 6800, and 5800 V200R005C10

This document describes the configurations of Security, including ACL, local attack defense, MFF, attack defense, traffic suppression and storm control, ARP security, Port security, DHCP snooping, ND snooping, PPPoE+, IPSG, SAVI, separating the management plane from the service plane, security risks.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Understanding URPF

Understanding URPF

Working Mode

On a complex network, the routes recorded on the local end and remote end may be different. A URPF-enabled device on this network may discard the packets transmitted along the correct path, but forward the invalid packets.

The device provides the following URPF modes to solve the preceding problem:

  • Strict check

    In strict mode, a packet passes the check only when the source IP address of the packet exists in the FIB table and the interface of the default route matches the inbound interface of the packet.

    If route symmetry is ensured, you are advised to use the URPF strict check. For example, if there is only one path between two network edge devices, URPF strict check can be used to ensure network security.

  • Loose check

    In loose mode, a packet passes the check as long as the source IP address of the packet matches an entry in the FIB table.

    If route symmetry is not ensured, you are advised to use the URPF loose check. For example, if there are multiple paths between two network edge devices, URPF loose check can be used to ensure network security.

Implementation

URPF enables the device to search for the source IP address of a received packet in the FIB table to obtain the matching inbound interface. If this inbound interface is different from the inbound interface of the packet, the device considers the source address as a spoofing one and discards the packet. In this manner, URPF can effectively protect the device against malicious attacks by modifying source IP addresses in packets.

Figure 15-2 Implementation

As shown in Figure 15-2, a bogus packet with source IP address 2.1.1.1 is sent from SwitchA to SwitchB. After receiving the bogus packet, SwitchB sends a response packet to the actual destination device SwitchC at 2.1.1.1. SwitchB and SwitchC are attacked by the bogus packets.

When SwitchB with URPF strict check enabled receives the bogus packet with source IP address 2.1.1.1, URPF discards the packet because the inbound interface of the source IP address is not the interface that receives the packet.

Translation
Download
Updated: 2019-04-20

Document ID: EDOC1100074765

Views: 18755

Downloads: 64

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next