Table of Contents
Advertisement
Use undo ip urpf to disable uRPF.
Syntax
ip urpf { loose [ allow-default-route ] | strict [ allow-default-route ] }
undo ip urpf
Default
uRPF is disabled.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
loose: Enables loose uRPF check. To pass loose uRPF check, the source address of a packet must
match the destination address of a FIB entry.
strict: Enables strict uRPF check. To pass strict uRPF check, the source address and receiving
interface of a packet must match the destination address and output interface of a FIB entry. You can
enable strict uRPF check only in VLAN interface view.
allow-default-route: Allows using the default route for uRPF check.
Usage guidelines
uRPF can be deployed on a PE connected to a CE or an ISP, or on a CE.
Configure strict uRPF check for traffic that uses symmetric path and configure loose uRPF check for
traffic that uses asymmetric path. A symmetric path exists for a session if the PE uses the same
interface to receive upstream traffic and send downstream traffic. The path is asymmetric if the PE
uses different interfaces to receive upstream traffic and send downstream traffic.
•
Typically, symmetric path applies to traffic that goes through an ISP's PE interface connected to
the CE. You can configure strict uRPF check on the PE interface.
•
Asymmetric path might exist for traffic that goes through a PE interface connected to another
ISP. In this case, configure loose uRPF check on the PE interface.
Typically, you do not need to configure the allow-default-route keyword on a PE device, because it
has no default route pointing to a CE. If you enable uRPF on a CE that has a default route pointing to
the PE, specify the allow-default-route keyword.
Examples
# Enable strict uRPF check globally.
<Sysname> system-view
[Sysname] ip urpf strict
Related commands
display ip urpf
655
Advertisement
Table of Contents
