HP 10500 series, Security Configuration Manual

Page: 465 / 596

451
Configuration procedure
A device supports uRPF configuration globally. Global uRPF configuration takes effect on all
interfaces.
Follow these guidelines when you configure uRPF:
•
uRPF is not supported on the LSUM1TGS48SG0(JH197A, JH205A) module.
•
uRPF checks only incoming packets on an interface.
•
uRPF does not check tunneled packets. For more information about tunneling, see Layer 3—IP
Services Configuration Guide .
•
In an MPLS network, an egress node cannot perform strict uRPF check on packets from the
penultimate hop to which the egress assigns an implicit null label. For more information about
the implicit null label, see
MPLS Configuration Guide .
•
Do not configure the allow-default-route keyword for loose uRPF check. Otherwise, uRPF
might fail to work.
To enable uRPF globally:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enable uRPF globally.
ip urpf { loose
[ allow-default-route ] | strict
[ allow-default-route ] }
By default, uRPF is disabled.
Displaying and maintaining uRPF
Execute display commands in any view.
Task Command
Display uRPF configuration (in standalone
mode).
display ip urpf [ slot slot-number ]
Display uRPF configuration (in IRF mode).
display ip urpf [ chassis chassis-number slot
slot-number ]
uRPF configuration example
Network requirements
As shown in Figure 135 , configure strict uRPF check on Switch B.
Configure strict uRPF check on Switch A and allow using the default route for uRPF check.
Figure 135 Network diagram
Configuration procedure
1. Configure strict uRPF check on Switch B.
Switch A
Switch B
IP network