System Interface; Unicast Rpf (Urpf) - Alcatel-Lucent 7710 SR OS Configuration Manual

System Interface

The system interface is associated with the network entity (such as a specific router or switch), not
a specific interface. The system interface is also referred to as the loopback address. The system
interface is associated during the configuration of the following entities:
•
•
•
The system interface is used to preserve connectivity (when routing reconvergence is possible)
when an interface fails or is removed. The system interface is also referred to as the loopback
address and is used as the router identifier. A system interface must have an IP address with a 32-
bit subnet mask.

Unicast RPF (uRPF)

This section applies to the 7750-SR, 7710-SR, 7950-SR and the 7450-ESS.
uRPF helps to mitigate problems that are caused by the introduction of malformed or forged
(spoofed) IP source addresses into a network by discarding IP packets that lack a verifiable IP
source address. For example, a number of common types of denial-of-service (DoS) attacks,
including smurf and tribe flood network (TFN), can take advantage of forged or rapidly changing
source IP addresses to allow attackers to thwart efforts to locate or filter the attacks. For Internet
service providers (ISPs) that provide public access, Unicast RPF deflects such attacks by
forwarding only packets that have source addresses that are valid and consistent with the IP routing
table. This action protects the network of the ISP, its customer, and the rest of the Internet.
In strict mode, uRPF checks whether the incoming packet has a source address that matches a
prefix in the routing table, and whether the interface expects to receive a packet with this source
address prefix.
In loose mode, uRPF checks whether the packet has a source address with a corresponding prefix
in the routing table; loose mode does not check whether the interface expects to receive a packet
with a specific source address prefix.
Loose uRPF check is supported for ECMP, IGP shortcuts and VPRN MP-BGP routes. Packets
coming from a source that matches any ECMP, IGP shortcut or VPRN MP-BGP route will pass the
uRPF check even when the uRPF mode is set to strict mode on the incoming interface.
If there is a default route in the router and the packets are coming from the interface that the default
route is pointing to, the following can occur:
Page 22
The termination point of service tunnels
The hops when configuring MPLS paths and LSPs
The addresses on a target router for BGP and LDP peering
7710 SR OS Router Configuration Guide