Login
- Table of Contents
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 05-uRPF configuration | 170.31 KB |
Contents
Restrictions and guidelines: uRPF configuration
Display and maintenance commands for uRPF
IPv6 uRPF application scenario
Restrictions and guidelines: IPv6 uRPF configuration
Enabling IPv6 uRPF on an interface
Display and maintenance commands for IPv6 uRPF
Configuring uRPF
About uRPF
Unicast Reverse Path Forwarding (uRPF) protects a network against source address spoofing attacks, such as DoS and DDoS attacks.
uRPF application scenario
Attackers send packets with a forged source address to access a system that uses IPv4-based authentication, in the name of authorized users or even the administrator. Even if the attackers or other hosts cannot receive any response packets, the attacks are still disruptive to the attacked target.
Figure 1 Source address spoofing attack
As shown in Figure 1, an attacker on Router A sends the server (Router B) requests with a forged source IP address 2.2.2.1 at a high rate. Router B sends response packets to IP address 2.2.2.1 (Router C). Consequently, both Router B and Router C are attacked. If the administrator disconnects Router C by mistake, the network service is interrupted.
Attackers can also send packets with different forged source addresses or attack multiple servers simultaneously to block connections or even break down the network.
uRPF can prevent these source address spoofing attacks. It checks whether an interface that receives a packet is the output interface of the FIB entry that matches the source address of the packet. If not, uRPF considers it a spoofing attack and discards the packet.
uRPF check modes
uRPF supports strict and loose modes.
Strict uRPF check
To pass strict uRPF check, the source address of a packet and the receiving interface must match the destination address and output interface of a FIB entry. In some scenarios (for example, asymmetrical routing), strict uRPF might discard valid packets.
Strict uRPF is often deployed between a PE and a CE.
Loose uRPF check
To pass loose uRPF check, the source address of a packet must match the destination address of a FIB entry. Loose uRPF can avoid discarding valid packets, but might let go attack packets.
Loose uRPF is often deployed between ISPs, especially in asymmetrical routing.
uRPF operation
Figure 2 shows how uRPF works.
1. uRPF checks address validity:
¡ uRPF permits a packet with a multicast destination address.
¡ uRPF proceeds to step 2 for packets not destined for multicast addresses.
2. uRPF checks whether the source address matches a unicast route:
¡ If yes, uRPF proceeds to step 3.
¡ If no, the packet is dropped. A non-unicast source address matches a non-unicast route.
3. uRPF checks whether the matching route is to the host itself:
¡ If yes, the output interface of the matching route is an InLoop interface. uRPF checks whether the receiving interface of the packet is an InLoop interface. If yes, it does not check the packet. If no, the packet is dropped.
¡ If no, uRPF proceeds to step 4.
4. uRPF checks whether the receiving interface matches the output interface of the matching FIB entry:
¡ If yes, the packet passes the check.
¡ If no, uRPF checks whether the check mode is loose. If yes, the packet passes the check. If no, the packet is dropped.
Network application
As shown in Figure 3, strict uRPF check is configured between an ISP network and a customer network. Loose uRPF check is configured between ISPs.
Restrictions and guidelines: uRPF configuration
If you enable uRPF on an interface, you can use the display ip interface command to display statistics about packets discarded by uRPF (displayed as "Drops" and "Suppressed drops").
Do not use strict uRPF if ECMP routing is available in the network. Service packets that travel along ECMP routes cannot pass the strict uRPF check and will be dropped.
Enabling uRPF on an interface
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
3. Enable uRPF.
ip urpf { loose | strict }
By default, uRPF is disabled.
Display and maintenance commands for uRPF
Execute display commands in any view.
|
Task |
Command |
|
Display uRPF configuration. |
display ip urpf [ interface interface-type interface-number ] [ slot slot-number ] |
Configuring IPv6 uRPF
About IPv6 uRPF
IPv6 Unicast Reverse Path Forwarding (uRPF) protects a network against source address spoofing attacks, such as DoS and DDoS attacks.
IPv6 uRPF application scenario
Attackers send packets with a forged source address to access a system that uses IPv6-based authentication, in the name of authorized users or even the administrator. Even if the attackers or other hosts cannot receive any response packets, the attacks are still disruptive to the attacked target.
Figure 4 Source address spoofing attack
As shown in Figure 4, an attacker on Router A sends the server (Router B) requests with a forged source IPv6 address 2000::1 at a high rate. Router B sends response packets to IPv6 address 2000::1 (Router C). Consequently, both Router B and Router C are attacked. If the administrator disconnects Router C by mistake, the network service is interrupted.
Attackers can also send packets with different forged source addresses or attack multiple servers simultaneously to block connections or even break down the network.
IPv6 uRPF can prevent these source address spoofing attacks. It checks whether an interface that receives a packet is the output interface of the FIB entry that matches the source address of the packet. If not, IPv6 uRPF considers it a spoofing attack and discards the packet.
IPv6 uRPF check modes
IPv6 uRPF supports strict and loose check modes.
Strict IPv6 uRPF check
To pass strict IPv6 uRPF check, the source address of a packet and the receiving interface must match the destination address and output interface of an IPv6 FIB entry. In some scenarios (for example, asymmetrical routing), strict IPv6 uRPF might discard valid packets.
Strict IPv6 uRPF is often deployed between a PE and a CE.
Loose IPv6 uRPF check
To pass loose IPv6 uRPF check, the source address of a packet must match the destination address of an IPv6 FIB entry. Loose IPv6 uRPF can avoid discarding valid packets, but might let go attack packets.
Loose IPv6 uRPF is often deployed between ISPs, especially in asymmetrical routing.
IPv6 uRPF operation
Figure 5 shows how IPv6 uRPF works.
1. IPv6 uRPF checks address validity:
¡ If the packet has a multicast destination address, IPv6 uRPF permits the packet.
¡ If the packet does not have a multicast destination address, IPv6 uRPF proceeds to step 2.
2. IPv6 uRPF checks whether the source address matches a unicast route:
¡ If yes, IPv6 uRPF proceeds to step 3.
¡ If no, the packet is dropped. A non-unicast source address matches a non-unicast route.
3. IPv6 uRPF checks whether the matching route is to the host itself:
¡ If yes, the output interface of the matching route is an InLoop interface. IPv6 uRPF checks whether the receiving interface of the packet is an InLoop interface. If yes, it permits the packet. If no, the packet is dropped.
¡ If no, IPv6 uRPF proceeds to step 4.
4. IPv6 uRPF checks whether the receiving interface matches the output interface of the matching IPv6 FIB entry:
¡ If yes, the packet passes the check.
¡ If no, IPv6 uRPF checks whether the check mode is loose. If yes, the packet passes the check. If no, the packet is discarded.
Network application
As shown in Figure 6, strict IPv6 uRPF check is configured between an ISP network and a customer network. Loose IPv6 uRPF check is configured between ISPs.
Restrictions and guidelines: IPv6 uRPF configuration
If you enable IPv6 uRPF on an interface, you can use the display ipv6 interface command to view statistics about packets discarded by IPv6 uRPF (displayed as "Drops" and "Suppressed drops").
Do not use strict IPv6 uRPF if ECMP routing is available in the network. Service packets that travel along ECMP routes cannot pass the strict uRPF check and will be dropped.
Enabling IPv6 uRPF on an interface
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
3. Enable IPv6 uRPF.
ipv6 urpf { loose | strict }
By default, IPv6 uRPF is disabled.
Display and maintenance commands for IPv6 uRPF
Execute display commands in any view.
|
Task |
Command |
|
Display IPv6 uRPF configuration. |
display ipv6 urpf [ interface interface-type interface-number ] [ slot slot-number ] |
