Unicast Reverse Path Forwarding

A number of common types of denial-of-service (DoS) attacks, including Smurf and Tribe Flood Network (TFN), can take advantage of forged or rapidly changing source IP addresses to allow attackers to thwart efforts to locate or filter the attacks. Reverse Path Forwarding (RPF) is designed to prevent such an attacker from spoofing a source IP address by checking that the source IP address specified for a packet is received from a network to which the device has access. Packets with invalid source IP addresses are not forwarded. RPF is supported for IPv4 and IPv6 packets. Differences in RPF support between IPv4 and IPv6 are noted within this section where necessary. RFC 3704, Ingress Filtering for Multihomed Networks, covers various aspects of the source IP address being spoofed in traffic being forwarded.

RUCKUS ICX devices support two unicast Reverse Path Forwarding (uRPF) modes according to RFC 3704:

• Strict mode: In this mode, all incoming packets are tested against the forwarding information base (FIB). If the incoming interface is not the best reverse path, the packet check fails. Failed packets are discarded by default. Source IP (SIP) lookup and the SIP next hop layer interface information is used in this mode. This mode has options to include default route check or exclude default route check. Including the default route check is the default configuration mode. Use the rpf-mode strict command for this mode. To exclude the default route check, you must include the option to urpf-exclude-default after entering the rpf-mode strict command.
• Loose mode: In this mode, each incoming packet's source address is tested against the forwarding information base. As long as there is a match for the source IP address in the forwarding information base, the traffic is allowed. Next hop interface information is not used in this mode. The packet is dropped only if the source address is not reachable through any interface on that router. This mode has options to include or exclude the default route check. Including the default route check is the default configuration mode. Use the rpf-mode loose command for this mode. To exclude the default route check, you must include the option to urpf-exclude-default after entering the rpf-mode loose command explicitly.