C h a p t e r
17
URPF Configuration
Table of Contents
URPF Overview................................................................ 157
Configuring URPF............................................................. 158
URPF Configuration Example ............................................. 159
URPF Maintenance and Diagnosis....................................... 160
URPF Overview
URPF
serves to prevent attacks with source address spoofing to
the network. Term "Reverse" is relative to normal route search. A
router will get destination address of the packet and search for a
route to the destination once it receives a packet. It will forward
the packet if such a route is found or simply discard the packet if
there is no available route to the destination.
Working Principle
URPF gets the source address and ingress interface of the packet
and uses source address as destination address to look up in the
forwarding table and see if the interface corresponding to the
source address matches the ingress interface.
When interface
does not match the ingress interface, it will regard source address
as a false address and then discard the packet. In this way, URPF
can effectively prevent malicious attacks by modifying the source
address to the network.
Module 1
A simple network module is shown in
Figure 37
.
F
IGURE
37 S
OURCE
A
DDRESS
S
NOOPING
1
When S1 uses a packet with a false source address 2.2.2.1 to
initiate a request to Server S2 which will send the packet to real
address 2.2.2.1 (that is, S3) while responding to the request. This
illegal packet will attack both S2 and S3.
Attackers may wage an attack by randomly changing source ad-
dress in the packet. In this example, source address is one of
reserved non-global IP addresses and thus is unreachable. A legal
Confidential and Proprietary Information of ZTE CORPORATION
157