Contents

IPv4 uRPF commands· 1

display ip urpf 1

ip urpf 1

IPv6 uRPF commands· 3

display ipv6 urpf 3

ipv6 urpf 3

IPv4 uRPF commands

display ip urpf

Use display ip urpf to display uRPF configuration.

Syntax

display ip urpf interface interface-type interface-number [ slot slot-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

interface interface-type interface-number: Specifies an interface by its type and number.

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays uRPF configuration on the master device.

Examples

# Display uRPF configuration on the specified interface.

<Sysname> display ip urpf interface vlan-interface 10 slot 1

uRPF configuration information of interface Vlan-interface10(failed):

   Check type: loose

Table 1 Command output

‌

ip urpf

Use ip urpf to enable uRPF.

Use undo ip urpf to disable uRPF.

Syntax

ip urpf { loose | strict }

undo ip urpf

Default

uRPF is disabled.

Views

Layer 3 interface view

Predefined user roles

network-admin

Parameters

loose: Enables loose uRPF check. To pass loose uRPF check, the source address of a packet must match the destination address of a FIB entry.

strict: Enables strict uRPF check. To pass strict uRPF check, the source address and receiving interface of a packet must match the destination address and output interface of a FIB entry.

Usage guidelines

uRPF can be deployed on a PE connected to a CE or an ISP, or on a CE.

Configure strict uRPF check for traffic that uses symmetric path and configure loose uRPF check for traffic that uses asymmetric path. A symmetric path exists for a session if the PE uses the same interface to receive upstream traffic and send downstream traffic. The path is asymmetric if the PE uses different interfaces to receive upstream traffic and send downstream traffic.

·     Typically, symmetric path applies to traffic that goes through an ISP's PE interface connected to the CE. You can configure strict uRPF check on the PE interface.

·     Asymmetric path might exist for traffic that goes through a PE interface connected to another ISP. In this case, configure loose uRPF check on the PE interface.

If the specified ACL does not exist or does not contain rules, the ACL cannot match any packets.

If the vpn-instance keyword is specified in an ACL rule, the rule applies only to VPN packets. If the vpn-instance keyword is not specified in an ACL rule, the rule applies only to public network packets.

You cannot enable both strict uRPF check and loose IPv6 uRPF check or loose uRPF check and strict IPv6 uRPF check on an interface.

You cannot enable uRPF on a tunnel interface.

Examples

# Configure loose uRPF check on VLAN-interface 10.

<Sysname> system-view

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] ip urpf loose

Related commands

display ip urpf

IPv6 uRPF commands

display ipv6 urpf

Use display ipv6 urpf to display IPv6 uRPF configuration.

Syntax

display ipv6 urpf interface interface-type interface-number [ slot slot-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

interface interface-type interface-number: Specifies an interface by its type and number.

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays IPv6 uRPF configuration on the master device.

Examples

# Display IPv6 uRPF configuration on the specified interface.

<Sysname> display ipv6 urpf interface vlan-interface 10 slot 1

IPv6 uRPF configuration information of interface Vlan-interface10(failed):

   Check type: loose

   Allow default route

   Suppress drop ACL: 2000

Table 2 Command output

‌

ipv6 urpf

Use ipv6 urpf to enable IPv6 uRPF.

Use undo ipv6 urpf to disable IPv6 uRPF.

Syntax

ipv6 urpf { loose | strict }

undo ipv6 urpf

Default

IPv6 uRPF is disabled.

Views

Layer 3 interface view

Predefined user roles

network-admin

Parameters

loose: Enables loose IPv6 uRPF check. To pass loose IPv6 uRPF check, the source address of a packet must match the destination address of an IPv6 FIB entry.

strict: Enables strict IPv6 uRPF check. To pass strict IPv6 uRPF check, the source address and receiving interface of a packet must match the destination address and output interface of an IPv6 FIB entry.

Usage guidelines

IPv6 uRPF can be deployed on a CE or on a PE connected to either a CE or an ISP.

Configure strict IPv6 uRPF check for traffic that uses symmetric path and configure loose IPv6 uRPF check for traffic that uses asymmetric path. A symmetric path exists for a session if the PE uses the same interface to receive upstream traffic and send downstream traffic. The path is asymmetric if the PE uses different interfaces to receive upstream traffic and send downstream traffic.

·     Typically, symmetric path applies to traffic that goes through an ISP's PE interface connected to the CE. You can configure strict IPv6 uRPF check on the PE interface or for the security zone to which the PE interface belongs.

·     Asymmetric path might exist for traffic that goes through a PE interface connected to another ISP. In this case, configure loose IPv6 uRPF check on the PE interface or for the security zone to which the PE interface belongs.

If the specified ACL does not exist or does not contain rules, the ACL cannot match any packets.

If the vpn-instance keyword is specified in an ACL rule, the rule applies only to VPN packets. If the vpn-instance keyword is not specified in an ACL rule, the rule applies only to public network packets.

You cannot enable both strict IPv6 uRPF check and loose uRPF check or loose IPv6 uRPF check and strict uRPF check on an interface.

You cannot enable IPv6 uRPF on a tunnel interface.

Examples

# Configure loose IPv6 uRPF check on VLAN-interface 10.

<Sysname> system-view

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] ipv6 urpf loose

Related commands

display ipv6 urpf