Rule ID
SV-273612r1110923_rule
Version
V1R1
CCIs
The uRPF feature is a defense against spoofing and denial-of-service (DoS) attacks by verifying if the source address of any ingress packet is reachable. To mitigate attacks that rely on forged source addresses, all provider edge routers must enable uRPF loose mode to guarantee that all packets received from a CE router contain source addresses that are in the route table.
Review the router configuration to determine if uRPF loose mode is enabled on all CE-facing interfaces. 1. Check that RPF is configured globally (requires reload when initially set). reverse-path-check 2. Review the router configuration to determine if uRPF loose mode is enabled on all CE-facing interfaces. Interface ethernet 1/1/1 rpf-mode loose If uRPF loose mode is not enabled on all CE-facing interfaces, this is a finding.
Enable uRPF loose mode on all CE-facing interfaces. 1. Configure reverse-path-check globally. ICX(config)#reverse-path-check reverse-path-check setting changes requires a reload to take effect! NOTE: Configuring reverse-path-check reduces following system-max by half. Following system-max will be reset to default. Please configure them after reload Please adjust/remove max-route configuration in any vrf before reload. Ip-route,ip6-route, ip-route-default-vrf, ip6-route-default-vrf, ip-route-vrf, ip6-route-vrf 2. Configure uRPF mode on CE interface(s). ICX(config)#interface ethernet 1/1/1 ICX(config-if-e10000-1/1/1)#rpf-mode loose