Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 967 / 2086

37-7
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 37 Configuring Unicast Reverse Path Forwarding
About Unicast Reverse Path Forwarding
Unicast RPF works with a single default route. No additional routes or routing protocols exist. Network
192.168.10.0/22 is a connected network. Packets arriving from the Internet with a source address in the
range 192.168.10.0/22 are dropped by Unicast RPF.
Routing Table Requirements
To work correctly, Unicast RPF needs proper information in the CEF tables. This requirement does not
mean that the switch must have the entire Internet routing table. The amount of routing information
needed in the CEF tables depends on where Unicast RPF is configured and what functions the switch
performs in the network. For example, in an ISP environment, a switch that is a leased-line aggregation
switch for customers needs only the information based on the static routes redistributed into the IGP or
IBGP (depending on which technique is used in the network). Unicast RPF is configured on the customer
interfaces, creating the requirement for minimal routing information. In another scenario, a
single-homed ISP could place Unicast RPF on the gateway link to the Internet. The full Internet routing
table is required. Requiring the full routing table helps protect the ISP from external DoS attacks that
use addresses that are not in the Internet routing table.
Where Not to Use Unicast RPF
Do not use Unicast RPF on interfaces that are internal to the network. Internal interfaces are likely to
have routing asymmetry (see
Figure 37-4 ), meaning multiple routes to the source of a packet. Apply
Unicast RPF only where there is natural or configured symmetry. Provided administrators carefully plan
which interfaces they activate Unicast RPF on, routing asymmetry is not a serious problem.
For example, switches at the edge of the network of an ISP are more likely to have symmetrical reverse
paths than switches that are in the core of the ISP network. Switches that are in the core of the ISP
network have no guarantee that the best forwarding path out of the switch is the path selected for packets
returning to the switch. We do not recommend that you apply Unicast RPF where there is a chance of
asymmetric routing, unless you use ACLs to allow the switch to accept incoming packets. ACLs permit
the use of Unicast RPF when packets will arrive by specific, less optimal asymmetric input paths.
However, it is simplest to place Unicast RPF only at the edge of a network or, for an ISP, at the customer
edge of the network.
Figure 37-4 illustrates how Unicast RPF can block legitimate traffic in an asymmetrical routing
environment.