Unicast Reverse Path Forwarding Unicast RPF
Unicast Reverse Path Forwarding (Unicast RPF) is a feature that can replace the use of RFC 2827 ingress traffic filtering techniques. Unicast RPF is configured and enabled on a perinterface basis. The main purpose of Unicast RPF is to verify that all packets received from a specific interface have a source address that is reachable via that same interface. The router drops all packets that do not comply.
NOTE You must turn on Cisco Express Forwarding (CEF) for Unicast RPF to work.
Two Unicast RPF modes are available:
• Strict mode: Requires that the source IP address of an incoming packet has a reverse path to the same interface from which it has arrived.
• Loose mode: Requires that the source IP address of an incoming packet has a reverse path to any interface on the device (except nullO). In many cases, an enterprise may have dual connections to the Internet; therefore, Unicast RPF strict mode is not feasible. Only use Unicast RPF strict mode in deployments where the reverse path entries match the traffic paths, otherwise you risk discarding legitimate traffic.
The following example demonstrates how to enable Unicast RPF strict mode on an interface (FastEthernet 1/0 in this case).
Router(config)# interface FastEthernet 1/0
Router(config-if)# ip verify unicast source reachable-via rx
The following example demonstrates how to enable Unicast RPF loose mode on an interface (Serial2 in this case).
Router(config)# interface Serial2
Router(config-if)# ip verify unicast source reachable-via any
Continue reading here: Cisco IOS Auto Secure
Was this article helpful?