Cisco Catalyst 4500 Series Configuration Manual page 761

Chapter 34 Configuring Unicast Reverse Path Forwarding
The packet is forwarded.
Step 5
This section provides information about Unicast RPF enhancements:
Access control lists and logging
•
• Per-interface statistics
Figure 34-1
verifying packet return paths. In this example, a customer has sent a packet having a source address of
192.168.1.1 from interface Gigabit Ethernet 1/1. Unicast RPF checks the FIB to see if 192.168.1.1 has
a path to Gigabit Ethernet 1/1. If there is a matching path, the packet is forwarded. If there is no matching
path, the packet is dropped.
Figure 34-1
Destination address x.x.x.x
Source address 192.168.1.1
Figure 34-2
has sent a packet having a source address of 209.165.200.225, which is received at interface Gigabit
Ethernet 1/1. Unicast RPF checks the FIB to see if 209.165.200.225 has a return path to Gigabit Ethernet
1/1. If there is a matching path, the packet is forwarded. There is no reverse entry in the routing table
that routes the customer packet back to source address 209.165.200.225 on interface Gigabit Ethernet
1/1, and so the packet is dropped.
OL-25340-01
illustrates how Unicast RPF and CEF work together to validate IP source addresses by
Unicast RPF Validating IP Source Addresses
Routing table:
192.168.0.0 via
172.19.0.0 is
CEF table:
192.168.0.0 172.19.66.7
172.19.0.0 attached
Adjacency table:
FDDI 2/0/0 172.19.66.7
Data IP header
In
Drop
RPF checks to see if
the reverse path for
the source address
matches the input port
illustrates how Unicast RPF drops packets that fail validation. In this example, a customer
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
172.19.66.7
directly connected, FDDI 2/0/0
FDDI 2/0/0
FDDI 2/0/0
50000603E...AAAA03000800
If okay, RPF passes
the packet to be
forwarded by CEF
Unicast
Data
RPF
Out
About Unicast Reverse Path Forwarding
IP header
34-3