Configuring Urpf; Urpf Configuration Example - HP 12500 Series Configuration Manual

URPF does a reverse route lookup for routes to the source address of the packet. If at least one
outgoing interface of such a route matches the receiving interface, the packet passes the check.
Otherwise, the packet is discarded. The reverse route lookup refers to searching the outgoing
interface whose destination IP address is the source IP address of the packet.
If the packet has its source IP address found in the FIB table and passes the check, URPF starts the
2.
link layer check:
If the link-check keyword is not configured, the packet passes the check and is forwarded
normally.
If the link-check keyword is configured, URPF compares the MAC address of the next hop in the
FIB entry with the source MAC address of the packet. If they are the same, the packet passes
the check. Otherwise, the packet is rejected.

Configuring URPF

Follow these guidelines when you configure URPF:
The switch does not support URPF check on an Ethernet interface card where more than eight ECMP
•
routes exist. For more information about ECMP routing, see Layer 3—IP Routing Configuration
Guide.
The link layer check feature does not support ECMP routing. If ECMP routes exist, disable the link
•
layer check feature.
• URPF check takes effect only on the VLAN interfaces of an Ethernet interface card.
URPF only checks incoming packets on an interface.
•
When the system operates in standard mode, do not configure URPF on a VLAN interface bound
•
to a VPN instance that has no reserved VLAN configured. For more information about system
operating modes, see Fundamentals Configuration Guide. For more information about the reserved
VLAN, see MPLS Configuration Guide.
To configure URPF:
Step
1. Enter system view.
2. Enter interface view.
3. Enable URPF check.

URPF configuration example

NOTE:
By default, Ethernet, VLAN, and aggregate interfaces are down. To configure such an interface, bring the
interface up by executing the undo shutdown command.
Network requirements
As shown in
URPF check on VLAN-interface 10 of Switch B to allow packets whose source addresses match ACL 2010
Command
system-view
interface interface-type interface-number
ip urpf strict [ link-check ]
Figure 101, a client (Switch A) directly connects to the ISP switch (Switch B). Enable strict
289
Remarks
N/A
N/A
URPF check is disabled by
default.