Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 966 / 2086

37-6
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 37 Configuring Unicast Reverse Path Forwarding
About Unicast Reverse Path Forwarding
ACLs work well for many single-homed customers; however, there are trade-offs when ACLs are used
as ingress filters, including two commonly referenced limitations:
• Packet per second (PPS) performance at very high packet rates
Note This restriction applies only to software packet forwarding. Hardware packet forwarding is the
same on both ACL and uRPF.
• Maintenance of the ACL (whenever new addresses are added to the network)
Unicast RPF is one tool that addresses both of these limitations. With Unicast RPF, ingress filtering is
done at CEF PPS rates. This processing speed makes a difference when the link is more than 1 Mbps.
Additionally, since Unicast RPF uses the FIB, no ACL maintenance is necessary, and thus the
administration overhead of traditional ACLs is reduced. The following figure and example demonstrate
how Unicast RPF is configured for ingress filtering.
Figure 37-3 illustrates an enterprise network that has a single link to an upstream ISP. In this example,
Unicast RPF is applied at interface Gigabit Ethernet 1/1 on the Enterprise switch for protection from
malformed packets arriving from the Internet. Unicast RPF is also applied at interface
Gigabit Ethernet 2/1 on the ISP switch for protection from malformed packets arriving from the
enterprise network.
Figure 37-3 Enterprise Network Using Unicast RPF for Ingress Filtering
Using the topography in Figure 37-3 , a typical configuration (assuming that CEF is turned on) on the
ISP switch appears as follows:
interface Gigabit Ethernet 2/1
description Link to Enterprise Network
ip address 192.168.3.1 255.255.255.255
no switchport
ip address 10.1.1.2 255.255.255.0
ip verify unicast source reachable-via rx allow-default
The gateway switch configuration of the enterprise network (assuming that CEF is turned on) appears as
follows:
interface Gigabit Ethernet 1/2
description ExampleCorp LAN
ip address 192.168.10.1 255.255.252.0
no ip redirects
no ip directed-broadcast
no ip proxy-arp
interface Gigabit Ethernet 1/1
description Link to Internet
no switchport
ip address 10.1.1.1 255.255.255.0
ip verify unicast source reachable-via allow-default
no ip proxy-arp
no ip redirects
no ip directed-broadcast
Internet
G2/1 G1/1
G1/2
Upstream
ISP
Enterprise
network 206530