Configuring the URPF Check Mode
Context
In a complicated networking environment, On a complex network, asymmetric routes may exist. That is, the routes recorded on the local end and remote end are different. A URPF-enabled device on this network may discard the packets transmitted along the correct path, but forward the invalid packets.
The device provides the following URPF modes to solve the preceding problem:
- Strict check
In strict mode, a packet passes the check only when the source IP address of the packet exists in the FIB table and the interface of the default route matches the inbound interface of the packet.
If route symmetry is ensured, you are advised to use the URPF strict check. For example, if there is only one path between two network edge devices, URPF strict check can be used to ensure network security.
- Loose check
In loose mode, a packet passes the check as long as the source IP address of the packet matches an entry in the FIB table.
If route symmetry is not ensured, you are advised to use the URPF loose check. For example, if there are multiple paths between two network edge devices, URPF loose check can be used to ensure network security.
Procedure
- Run system-view
The system view is displayed.
- Configuring the URPF Check Mode (CE12800E):
- On an Ethernet interface, run undo portswitch
The interface is switched to Layer 3 mode.
By default, an Ethernet interface works in Layer 2 mode.
If an Ethernet interface already has Layer 2 configuration, this command fails to be executed on the interface. Before running this command on the interface, delete all the Layer 2 configuration of the interface.
If many Ethernet interfaces need to be switched to Layer 3 mode, run the undo portswitch batch interface-type { interface-number1 [ to interface-number2 ] } &<1-10> command in the system view to switch these interfaces to Layer 3 mode in batches.
- On an Ethernet interface, run undo portswitch
- Configuring the URPF Check Mode (CE12800):
Run ip urpf { loose | strict | allow-default-route }
The global URPF check mode is configured.
By default, URPF check is not globally enabled. If URPF check is enabled on the interface, URPF check is in loose mode.
- Run commit
The configuration is committed.
