Login
- Table of Contents
-
- 11-Security Command Reference
- 00-Preface
- 01-AAA commands
- 02-802.1X commands
- 03-MAC authentication commands
- 04-Portal commands
- 05-Web authentication commands
- 06-Port security commands
- 07-Password control commands
- 08-Keychain commands
- 09-Public key management commands
- 10-PKI commands
- 11-IPsec commands
- 12-SSH commands
- 13-SSL commands
- 14-Object group commands
- 15-Attack detection and prevention commands
- 16-TCP attack prevention commands
- 17-IP source guard commands
- 18-ARP attack protection commands
- 19-ND attack defense commands
- 20-uRPF commands
- 21-MFF commands
- 22-FIPS commands
- 23-MACsec commands
- 24-802.1X client commands
- 25-Microsegmentation commands
- 26-SAVA commands
- 27-Crypto engine commands
- 28-IP-SGT mapping commands
- 29-User profile commands
- 30-CloudSec commands
- 31-SAVI commands
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 20-uRPF commands | 73.87 KB |
IPv4 uRPF commands
display ip urpf
Use display ip urpf to display uRPF configuration.
Syntax
In standalone mode:
display ip urpf interface interface-type interface-number [ slot slot-number ]
In IRF mode:
display ip urpf interface interface-type interface-number [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
mdc-admin
mdc-operator
Parameters
interface interface-type interface-number: Specifies an interface by its type and number.
slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays uRPF configuration on the active MPU. (In standalone mode.)
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays uRPF configuration on the global active MPU. (In IRF mode.)
Examples
# (In standalone mode.) Display uRPF configuration on the specified interface.
<Sysname> display ip urpf interface vlan-interface 10 slot 3
uRPF configuration information of interface Vlan-interface10(failed):
Check type: loose
Allow default route
Table 1 Command output
|
Field |
Description |
|
(failed) |
The system failed to deliver the uRPF configuration to the forwarding chip because of insufficient chip resources. This field is not displayed if the delivery is successful. |
|
Check type |
uRPF check mode: loose or strict. |
|
Allow default route |
Using the default route is allowed. |
ip urpf
Use ip urpf to enable uRPF.
Use undo ip urpf to disable uRPF.
Syntax
ip urpf { loose [ allow-default-route ] | strict [ allow-default-route ] }
undo ip urpf
Default
uRPF is disabled.
Views
Layer 3 interface view
Predefined user roles
network-admin
mdc-admin
Parameters
loose: Enables loose uRPF check. To pass loose uRPF check, the source address of a packet must match the destination address of a FIB entry.
strict: Enables strict uRPF check. To pass strict uRPF check, the source address and receiving interface of a packet must match the destination address and output interface of a FIB entry.
allow-default-route: Allows using the default route for uRPF check. This keyword is supported on only the following modules:
· SC modules prefixed with LSCM2.
· SD interface modules.
· SF interface modules.
Usage guidelines
|
|
CAUTION: This command is not supported on Layer 2 interfaces. If you configure this command in Layer 2 interface view, the uRPF configuration will take effect in system view. |
uRPF can be deployed on a PE connected to a CE or an ISP, or on a CE.
Configure strict uRPF check for traffic that uses symmetric path and configure loose uRPF check for traffic that uses asymmetric path. A symmetric path exists for a session if the PE uses the same interface to receive upstream traffic and send downstream traffic. The path is asymmetric if the PE uses different interfaces to receive upstream traffic and send downstream traffic.
· Typically, symmetric path applies to traffic that goes through an ISP's PE interface connected to the CE. You can configure strict uRPF check on the PE interface.
· Asymmetric path might exist for traffic that goes through a PE interface connected to another ISP. In this case, configure loose uRPF check on the PE interface.
Typically, you do not need to configure the allow-default-route keyword on a PE device, because it has no default route pointing to a CE. If you enable uRPF on a CE interface and the CE interface has a default route pointing to the PE, specify the allow-default-route keyword. If you enable uRPF on a security zone where the CE interface resides and the security zone has a default route pointing to the PE, specify the allow-default-route keyword.
You cannot enable both strict uRPF check and loose IPv6 uRPF check or loose uRPF check and strict IPv6 uRPF check on an interface.
Examples
# Configure loose uRPF check on VLAN-interface 10.
<Sysname> system-view
[Sysname] interface vlan-interface 10
[Sysname-Vlan-interface10] ip urpf loose
Related commands
display ip urpf
IPv6 uRPF commands
display ipv6 urpf
Use display ipv6 urpf to display IPv6 uRPF configuration.
Syntax
In standalone mode:
display ipv6 urpf interface interface-type interface-number [ slot slot-number ]
In IRF mode:
display ipv6 urpf interface interface-type interface-number [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
mdc-admin
mdc-operator
Parameters
interface interface-type interface-number: Specifies an interface by its type and number.
slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays IPv6 uRPF configuration on the active MPU. (In standalone mode.)
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays IPv6 uRPF configuration on the global active MPU. (In IRF mode.)
Examples
# (In standalone mode.) Display IPv6 uRPF configuration on the specified interface.
<Sysname> display ipv6 urpf interface vlan-interface 10 slot 3
IPv6 uRPF configuration information of interface Vlan-interface10(failed):
Check type: loose
Allow default route
Table 2 Command output
|
Field |
Description |
|
(failed) |
The system failed to deliver the IPv6 uRPF configuration to the forwarding chip because of insufficient chip resources. This field is not displayed if the delivery is successful. |
|
Check type |
IPv6 uRPF check mode: loose or strict. |
|
Allow default route |
Using the default route is allowed. |
ipv6 urpf
Use ipv6 urpf to enable IPv6 uRPF.
Use undo ipv6 urpf to disable IPv6 uRPF.
Syntax
ipv6 urpf { loose | strict } [ allow-default-route ]
undo ipv6 urpf
Default
IPv6 uRPF is disabled.
Views
Layer 3 interface view
Predefined user roles
network-admin
mdc-admin
Parameters
loose: Enables loose IPv6 uRPF check. To pass loose IPv6 uRPF check, the source address of a packet must match the destination address of an IPv6 FIB entry.
strict: Enables strict IPv6 uRPF check. To pass strict IPv6 uRPF check, the source address and receiving interface of a packet must match the destination address and output interface of an IPv6 FIB entry.
allow-default-route: Allows using the default route for IPv6 uRPF check. This keyword is supported on only the following modules:
· SC modules prefixed with LSCM2.
· SD interface modules.
· SF interface modules.
Usage guidelines
|
|
CAUTION: This command is not supported on Layer 2 interfaces. If you configure this command in Layer 2 interface view, the IPv6 uRPF configuration will take effect in system view. |
IPv6 uRPF can be deployed on a CE or on a PE connected to either a CE or an ISP.
Configure strict IPv6 uRPF check for traffic that uses symmetric path and configure loose IPv6 uRPF check for traffic that uses asymmetric path. A symmetric path exists for a session if the PE uses the same interface to receive upstream traffic and send downstream traffic. The path is asymmetric if the PE uses different interfaces to receive upstream traffic and send downstream traffic.
· Typically, symmetric path applies to traffic that goes through an ISP's PE interface connected to the CE. You can configure strict IPv6 uRPF check on the PE interface.
· Asymmetric path might exist for traffic that goes through a PE interface connected to another ISP. In this case, configure loose IPv6 uRPF check on the PE interface.
Typically, you do not need to configure the allow-default-route keyword on a PE device, because it has no default route pointing to a CE. If you enable IPv6 uRPF on a CE interface and the CE interface has a default route pointing to the PE, specify the allow-default-route keyword. If you enable uRPF on a security zone where the CE interface resides and the security zone has a default route pointing to the PE, specify the allow-default-route keyword.
You cannot enable both strict IPv6 uRPF check and loose uRPF check or loose IPv6 uRPF check and strict uRPF check on an interface.
Examples
# Configure loose IPv6 uRPF check on VLAN-interface 10.
<Sysname> system-view
[Sysname] interface vlan-interface 10
[Sysname-Vlan-interface10] ipv6 urpf loose
Related commands
display ipv6 urpf
