09-Security Command Reference

HomeSupportResource CenterReference GuidesCommand ReferencesH3C S6805 & S6825 & S6850 & S9850 Command References-Release 66xx-6W10309-Security Command Reference
20-uRPF commands
Title Size Download
20-uRPF commands 48.22 KB

uRPF commands

display ip urpf

Use display ip urpf to display uRPF configuration.


display ip urpf [ interface interface-type interface-number ] [ slot slot-number ]


Any view

Predefined user roles




interface interface-type interface-number: Specifies an interface by its type and number.

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays uRPF configuration for all member devices.


# Display uRPF configuration for the specified slot.

<Sysname> display ip urpf slot 1

Global uRPF configuration information(failed):

   Check type: strict

   Allow default route

# Display uRPF configuration on the specified interface.

<Sysname> display ip urpf interface vlan-interface 10 slot 1

uRPF configuration information of interface Vlan-interface10(failed):

   Check type: loose

   Allow default route

Table 1 Command output




The system failed to deliver the uRPF configuration to the forwarding chip because of insufficient chip resources.

This field is not displayed if the delivery is successful.

Check type

uRPF check mode: loose or strict.

Allow default route

Using the default route is allowed.


ip urpf

Use ip urpf to enable uRPF.

Use undo ip urpf to disable uRPF.


ip urpf { loose [ allow-default-route ] | strict [ allow-default-route ] }

undo ip urpf


uRPF is disabled.


System view

Interface view

Predefined user roles



loose: Enables loose uRPF check. To pass loose uRPF check, the source address of a packet must match the destination address of a FIB entry.

strict: Enables strict uRPF check. To pass strict uRPF check, the source address and receiving interface of a packet must match the destination address and output interface of a FIB entry.

allow-default-route: Allows using the default route for uRPF check.

Usage guidelines

uRPF can be deployed on a PE connected to a CE or an ISP, or on a CE.

Configure strict uRPF check for traffic that uses symmetric path and configure loose uRPF check for traffic that uses asymmetric path. A symmetric path exists for a session if the PE uses the same interface to receive upstream traffic and send downstream traffic. The path is asymmetric if the PE uses different interfaces to receive upstream traffic and send downstream traffic.

·     Typically, symmetric path applies to traffic that goes through an ISP's PE interface connected to the CE. You can configure strict uRPF check on the PE interface.

·     Asymmetric path might exist for traffic that goes through a PE interface connected to another ISP. In this case, configure loose uRPF check on the PE interface.

Typically, you do not need to configure the allow-default-route keyword on a PE device, because it has no default route pointing to a CE. If you enable uRPF on a CE interface and the CE interface has a default route pointing to the PE, specify the allow-default-route keyword.


# Enable strict uRPF check globally.

<Sysname> system-view

[Sysname] ip urpf strict

# Configure loose uRPF check on VLAN-interface 10.

<Sysname> system-view

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] ip urpf loose

Related commands

display ip urpf


  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
All Support
  • Become a Partner
  • Partner Resources
  • Partner Business Management
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us