172
URPF configuration
URPF overview
What is URPF
Unicast Reverse Path Forwarding (URPF) protects a network against source address spoofing
attacks.
Attackers launch attacks by creating a series of packets with forged source addresses. For
applications using IP-address-based authentication, this type of attacks allows unauthorized users
to access the system in the name of authorized users, or even access the system as the
administrator. Even if the attackers cannot receive any response packets, the attacks are still
disruptive to the attacked target.
Figure 61
Attack based on source address spoofing
Switch A originates a request to the server (Switch B) by sending a packet with a forged source IP
address of 2.2.2.1/8, and Switch B sends a packet to Switch C at 2.2.2.1/8 in response to the
request. Consequently, both Switch B and Switch C are attacked. See Figure 59.
URPF can prevent source address spoofing attacks.
How URPF works
URPF works as follows:
1.
If the source IP address of an incoming packet is found in the FIB table:
URPF does a reverse route lookup for routes to the source address of the packet. If at least one
outgoing interface of such a route matches the receiving interface, the packet passes the check.
Otherwise, the packet is rejected. The reverse route lookup refers to searching the outgoing
interface whose destination IP address is the source IP address of the packet.
