Urpf; Introduction To Urpf - Edge-Core ES4624-SFP Basic Management Manual

Default: Optimized IP route aggregation algorithm is disabled by default.
Command mode: Global Mode
Usage Guide: This command is used to optimize the aggregation algorithm: if the route
table contains no default route, the next hop most frequently referred to will be used to
construct a virtual default route to simplify the aggregation result. This method has the
benefit of more effectively simplifying the aggregation result. However, while adding a
virtual default route to the chip segment route table reduces CPU load, it may introduce
unnecessary data stream to switches of the next hop. In fact, part of local switch CPU
load is transferred to switches of the next hop.
Example: Disabling optimized IP route aggregation algorithm.
Switch(config)# no ip fib optimize

13.4 URPF

13.4.1 Introduction to URPF

URPF (Unicast Reverse Path Forwarding) introduces the RPF technology applied in
multicast to unicast, so to protect the network from the attacks which is based on source
address cheat.
When switch receives the packet, it will search the route in the route table using the
source address as the destination address which is acquired from the packet. If the found
router exit interface does not match the entrance interface acquired from this packet, the
switch will consider this packet a fake packet and discard it.
In Source Address Spoofing attacks, attackers will construct a series of messages
with fake source addresses. For applications based on IP address verification, such
attacks may allow unauthorized users to access the system as some authorized ones, or
even the administrator. Even if the response messages can't reach the attackers, they
will also damage the targets.
1.1.1.8/8
Router A
In the above figure, Router A sends requests to the server Router B by faking
messages whose source address are 2.2.2.1/8 .In response, Router B will send the
messages to the real "2.2.2.1/8". Such illegal messages attack both Router B and Router
2.2.2.1/8
Source IP：
Router B
393
2.2.2.1/8
Router C