HP VSR1000 Security Configuration Manual page 335

1. uRPF checks address validity:
Permits a packet with a multicast destination address.
For a packet with an all-zero source address, permits the packet if it has a broadcast destination
address. (A packet with source address 0.0.0.0 and destination address 255.255.255.255
might be a DHCP or BOOTP packet and cannot be discarded.); proceeds to step 7 if the packet
has a non-broadcast destination address.
Proceeds to step 2 for other packets.
2. uRPF checks whether the source address matches a unicast route:
If yes, proceeds to step 3.
If no, proceeds to step 7. A non-unicast source address matches a non-unicast route.
3. uRPF checks whether the matching route is to the host itself:
If yes, the output interface of the matching route is an InLoop interface. uRPF checks whether the
receiving interface of the packet is an InLoop interface. If yes, does not check the packet. If no,
proceeds to step 7.
If no, proceeds to step 4.
4. uRPF checks whether the matching route is a default route:
If yes, uRPF checks whether the allow-default-route keyword is configured to allow using the
default route. If yes, proceeds to step 5. If no, proceeds to step 7.
If no, proceeds to step 5.
5. uRPF checks whether the receiving interface matches the output interface of the matching FIB entry:
If yes, proceeds to step 6.
If no, uRPF checks whether the check mode is loose. If yes, proceeds to step 6. If no, proceeds
to step 7.
6. uRPF checks whether the link-check keyword is configured for link layer check:
If no, the packet passes the check.
If yes, uRPF uses the next-hop address of the FIB entry to look up the ARP table for a matching
entry. Then it checks whether the MAC address of the matching ARP entry is identical with the
source MAC address of the packet. If yes, the packet passes the check. If no, proceeds to step
7.
7. uRPF checks whether the packet is permitted by the ACL:
If yes, the packet is forwarded (such a packet is displayed in the uRPF information as a
"suppressed drop").
If no, the packet is discarded.
325