Example for Configuring URPF (CE12800)
Networking Requirements
As shown in Figure 15-6, the Switch is connected to the Internet Service Provider (ISP) router through 10GE1/0/1 and connected to user networks through 10GE2/0/1. The administrator wants that the Switch can defend against source address spoofing attacks. If the Switch cannot provide this function, unauthorized users will occupy too many service resources by sending valid service requests, and authorized users cannot communicate with each other due to no response.
Configuration Roadmap
Add the user-side interface 10GE2/0/1 of the switch to a Virtual Local Area Network (VLAN) and configure URPF on the VLANIF interface to prevent source IP address spoofing attacks from users.
Route symmetry is ensured in this example, so the URPF strict check is used.
Procedure
- Configure the URPF check mode.
<HUAWEI> system-view [~HUAWEI] sysname Switch [*HUAWEI] commit [~Switch] ip urpf strict
- Add interfaces to VLANs and assign IP addresses to the VLANIF interfaces.
[*Switch] vlan batch 10 [*Switch] interface 10ge 2/0/1 [*Switch-10GE2/0/1] port link-type access [*Switch-10GE2/0/1] port default vlan 10 [*Switch-10GE2/0/1] quit [*Switch] interface vlanif 10 [*Switch-Vlanif10] ip address 10.164.1.1 255.255.255.0 [*Switch-Vlanif10] quit
- Enable URPF on the interface.
[*Switch] interface vlanif 10 [*Switch-Vlanif10] ip urpf enable [*Switch-Vlanif10] commit [~Switch-Vlanif10] quit
- Verify the configuration.
Run the display this command in the system view to check the URPF configuration.
[~Switch] display this # ip urpf strict # vlan batch 10 #