H3C MSR Series Command Reference Manual page 1148

Views
Interface view
Predefined user roles
network-admin
Parameters
loose: Enables loose uRPF check. To pass loose uRPF check, the source address of a packet must
match the destination address of a FIB entry.
strict: Enables strict uRPF check. To pass strict uRPF check, the source address and receiving
interface of a packet must match the destination address and output interface of a FIB entry.
allow-default-route: Allows using the default route for uRPF check.
acl acl-number: Specifies an ACL by its number.
•
For a basic ACL, the value range is 2000 to 2999.
•
For an advanced ACL, the value range is 3000 to 3999.
link-check: Enables link layer check (Ethernet link).
Usage guidelines
uRPF can be deployed on a PE connected to a CE or another ISP, or on a CE.
Configure strict uRPF check on a PE interface connected to a CE, and configure loose uRPF check
on a PE interface connected to another ISP.
For asymmetrical routing, configure loose uRPF to avoid discarding valid packets. For symmetrical
routing, configure strict uRPF. An ISP usually adopts symmetrical routing on a PE device.
Typically, you do not need to configure the allow-default-route keyword on a PE device, because it
has no default route pointing to a CE. If you enable uRPF on a CE that has a default route pointing to
the PE, specify the allow-default-route keyword.
You can use an ACL to match specific packets, so they are forwarded even if they fail to pass uRPF
check.
If a Layer 3 PE interface connects to a large number of PCs, configure the link-check keyword on
the interface to enable link layer check. uRPF checks the validity of the source MAC address.
Examples
# Configure strict uRPF check on interface GigabitEthernet 1/0/2 and allow using the default route
and ACL 2999 to match packets.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/2
[Sysname-GigabitEthernet1/0/2] ip urpf strict allow-default-route acl 2999
# Configure loose uRPF check on interface GigabitEthernet 1/0/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] ip urpf loose
Related commands
display ip urpf
1125