Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 968 / 2086

37-8
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 37 Configuring Unicast Reverse Path Forwarding
About Unicast Reverse Path Forwarding
Figure 37-4 Unicast RPF Blocking Traffic in an Asymmetrical Routing Environment
Unicast RPF with BOOTP and DHCP
Unicast RPF will allow packets with 0.0.0.0 source and 255.255.255.255 destination to pass so that
Bootstrap Protocol (BOOTP) and Dynamic Host Configuration Protocol (DHCP) functions work
properly.
Restrictions
Restrictions for applying Unicast RPF to multihomed clients include the following:
•
Clients should not be multihomed to the same switch because action defeats the purpose of building
a redundant service for the client.
• Customers must ensure that the packets flowing up the link (out to the Internet) match the route
advertised out the link. Otherwise, Unicast RPF filters those packets as malformed packets.
Limitation
Unicast loose mode is not supported.
Related Features and Technologies
For more information about Unicast RPF-related features and technologies, review the following:
•
Unicast RPF requires Cisco express forwarding (CEF) to function properly on the switch. For more
information about CEF, refer to the
Cisco IOS Switching Services Configuration Guide .
•
Unicast RPF can be more effective at mitigating spoofing attacks when combined with a policy of
ingress and egress filtering using Cisco IOS access control lists (ACLs).
ISP
network
The Internet
Site A
S1
S0
Best route to
site A from ISP
Best route to
ISP from site A
33407
Unicast RPF applied
to S1 would BLOCK
traffic from site A
Unicast RPF applied
to S0 would not
block traffic to
site A