Understanding URPF
Working Mode
On a complex network, the routes recorded on the local end and remote end may be different. A URPF-enabled device on this network may discard the packets transmitted along the correct path, but forward the invalid packets.
The device provides the following URPF modes to solve the preceding problem:
- Strict check
In strict mode, a packet passes the check only when the source IP address of the packet exists in the FIB table and the interface of the default route matches the inbound interface of the packet.
If route symmetry is ensured, you are advised to use the URPF strict check. For example, if there is only one path between two network edge devices, URPF strict check can be used to ensure network security.
- Loose check
In loose mode, a packet passes the check as long as the source IP address of the packet matches an entry in the FIB table.
If route symmetry is not ensured, you are advised to use the URPF loose check. For example, if there are multiple paths between two network edge devices, URPF loose check can be used to ensure network security.
Implementation
URPF enables the device to search for the source IP address of a received packet in the FIB table to obtain the matching inbound interface. If this inbound interface is different from the inbound interface of the packet, the device considers the source address as a spoofing one and discards the packet. In this manner, URPF can effectively protect the device against malicious attacks by modifying source IP addresses in packets.
As shown in Figure 15-2, a bogus packet with source IP address 2.1.1.1 is sent from SwitchA to SwitchB. After receiving the bogus packet, SwitchB sends a response packet to the actual destination device SwitchC at 2.1.1.1. SwitchB and SwitchC are attacked by the bogus packets.
When SwitchB with URPF strict check enabled receives the bogus packet with source IP address 2.1.1.1, URPF discards the packet because the inbound interface of the source IP address is not the interface that receives the packet.