437
Configuring URPF
URPF protects a network against source address spoofing attacks.
Attackers launch attacks by creating a series of packets with forged source addresses. For applications
using IP-address-based authentication, this type of attack allows unauthorized users to access the system
in the name of authorized users or even to access the system as the administrator. Even if the attackers
cannot receive any response packets, the attacks are still disruptive to the attacked target.
Figure 153
Attack based on source address spoofing
As shown in
, Router A originates a request to the server (Router B) by sending a packet with
a forged source IP address of 2.2.2.1/8, and Router B sends a packet to Router C at 2.2.2.1/8 in
response to the request. Consequently, both Router B and Router C are attacked.
URPF can prevent source address spoofing attacks.
How URPF works
URPF provides two check modes: strict and loose. In addition, it supports ACL check and default route
check.
URPF works as follows:
1.
URPF checks the source address validity, and then does the following:
{
Discards packets with a broadcast address as the source.
{
Discards packets with an all-zero source address but a non-broadcast destination address. (A
packet with source address 0.0.0.0 and destination address 255.255.255.255 might be a
DHCP or BOOTP packet, and it is not discarded.)
2.
If the source address of an incoming packet is found in the FIB table:
{
In strict approach, URPF does a reverse route lookup for routes to the source address of the
packet. If at least one outgoing interface of such a route matches the receiving interface, the
packet passes the check. Otherwise, the packet is rejected.
{
In loose approach, the packet passes the check.
3.
If the source address is not found in the FIB table, URPF makes a decision based on the default
route and the
allow-default-route
keyword.
{
If no default route is available, the packet is rejected regardless of which check approach is
taken.
{
If a default route is available but the
allow-default-route
keyword is not configured, the packet
is rejected regardless of which check approach is taken.
