The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The CISCO-IP-URPF-MIB support provides Simple Network Management Protocol (SNMP) notification when a specified drop-rate threshold on a managed device is exceeded. You can use the IP Unicast Reverse Path Forwarding (RPF) feature to avert denial of service (DoS) attacks by verifying the validity of the source IP of an incoming packet. You can configure the Unicast RPF drop-rate threshold globally for a device or per interface.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for CISCO-IP-URPF-MIB Support" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
•Prerequisites for CISCO-IP-URPF-MIB Support
•Restrictions for CISCO-IP-URPF-MIB Support
•Information About CISCO-IP-URPF-MIB Support
•How to Configure Unicast RPF Drop-Rate Notification
•Configuration Examples for CISCO-IP-URPF-MIB Support
•Feature Information for CISCO-IP-URPF-MIB Support
Before you configure CISCO-IP-URPF-MIB, you must configure the following features:
•Cisco Express Forwarding switching
•IP routing
•SNMP
•Unicast RPF
•Because Cisco IOS software does not support VPN routing and forwarding (VRF)-specific Unicast RPF counters, it does not support the following MIB objects related to VRF:
–cipUrpfIfVrfName
–cipUrpfVrfName
–cipUrpfVrfIfDrops
–cipUrpfVrfIfDiscontinuityTime
•This implementation of the CISCO-IP-URPF MIB supports only IPv4.
•Implementation of Unicast RPF Notification
•Elements of Unicast RPF Notification
Unicast RPF is a security feature that verifies the validity of the source IP of an incoming packet. When a packet arrives at an interface and its source IP is unknown in the routing table or is a known bad source address, Unicast RPF drops the packet. IP verification of the source is done to prevent the DoS attacks by detecting problems with the incoming packets on an interface. However, deploying Unicast RPF without some automated monitoring capability is a challenge.
The CISCO-IP-URPF-MIB lets you specify a Unicast RPF drop-rate threshold on interfaces of a managed device that will send an SNMP notification when the threshold is exceeded. The MIB includes objects for specifying global and per-interface drop counts and drop rates and a method to generate SNMP traps when the drop rate exceeds a configurable per-interface threshold.
Although you can configure some parameters globally, you must configure the CISCO-IP-URPF-MIB on individual interfaces.
The elements described in the following sections make Unicast RPF drop-rate notification work:
•How to Configure Unicast RPF Drop-Rate Notification
Whenever Unicast RPF is configured on an interface, the drop-rate calculation is done periodically (at intervals specified by the cipUrpfComputeInterval object). Drop rates are computed over a constantly sliding window, whose period starts at the configured number of seconds before the calculation and ends with the performance of the calculation.
The following global scalars affect how the MIB agent computes all drop rates and generates notifications:
•cipUrpfDropRateWindow—This object specifies the window of time in the recent past over which the drop rate computation occurs. If there was no window (that is, the window is the epoch since booting up), an identical drop count burst at a later time would produce a lower drop rate than the one occurring earlier.
•cipUrpfComputeInterval—This object specifies how often the drop-rate computation occurs.
•cipUrpfDropNotifyHoldDownTime—This object specifies the minimum time between notifications for a particular packet flow on an interface.
The CISCO-IP-URPF-MIB includes the following global tables:
•cipUrpfTable—This table contains the global drop count and drop-rate objects per packet flow. These global rates are useful for quickly determining whether the managed device had Unicast RPF activity at a specific time.
•cipUrpfVrfTable—This table contains the index drop counters by VRF (if a VRF routing table is used to determine Unicast RPF checking). The table provides a method for VRF to index all the Unicast RPF-enabled interfaces.
The following MIB objects enable per-interface configuration:
•cipUrpfIfDropRateNotifyEnable—This object specifies whether the system produces the cipUrpfIfDropRateNotify notification because Unicast RPF has dropped version cipUrpfIfIpVersion IP packets on the specified interface.
•cipUrpfIfNotifyDropRateThreshold—This object specifies the drop-rate threshold value above which a notification is generated.
The following MIB objects track per-interface statistics:
•cipUrpfIfMonTable—This table contains the statistics for a particular packet flow on an interface.
•cipUrpfIfDrops—This object accumulates Unicast RPF drops on an interface. Snapshots of this value are used in the drop-rate computation. The computed drop rate is specified in the cipUrpfIfDropRate object. If Unicast RPF is configured on a subinterface, drop rates are computed.
•Configuring Unicast RPF Drop-Rate Notification via Syslog (required)
•Configuring Unicast RPF Drop-Rate Notification via SNMP (required)
Perform this task to configure the Unicast RPF drop-rate threshold and computation parameters for notification via syslog.
1. enable
2. configure terminal
3. ip verify drop-rate compute window seconds
4. ip verify drop-rate compute interval seconds
5. ip verify drop-rate notify hold-down seconds
6. interface type number
7. ip verify unicast notification threshold packets-per-second
8. end
9. show ip interface type number
10. debug ip verify mib
Perform this task to configure the Unicast RPF drop-rate threshold and computation parameters for notification via SNMP.
1. enable
2. configure terminal
3. ip verify drop-rate compute window seconds
4. ip verify drop-rate compute interval seconds
5. ip verify drop-rate notify hold-down seconds
6. interface type number
7. ip verify unicast notification threshold packets-per-second
8. snmp trap ip verify drop-rate
9. end
10. show ip interface type number
11. debug ip verify mib
•Example: Configuring Unicast RPF Drop-Rate Notification via Syslog
•Example: Configuring Unicast RPF Drop-Rate Notification via SNMP
•Example: Verifying and Troubleshooting the Unicast RPF Configuration
The following example shows how to configure Unicast RPF drop-rate notification via syslog:
Router> enable
Router# configure terminal
Router(config)# ip verify drop-rate compute window 60
Router(config)# ip verify drop-rate compute interval 60
Router(config)# ip verify drop-rate notify hold-down 60
Router(config)# interface ethernet 3/0
Router(config-if)# ip verify unicast notification threshold 750
Router(config-if)# end
The following example shows how to configure Unicast RPF drop-rate notification via SNMP:
Router> enable
Router# configure terminal
Router(config)# ip verify drop-rate compute window 60
Router(config)# ip verify drop-rate compute interval 60
Router(config)# ip verify drop-rate notify hold-down 60
Router(config)# interface ethernet 3/0
Router(config-if)# ip verify unicast notification threshold 750
Router(config-if)# snmp trap ip verify drop-rate
Router(config-if)# end
The following is sample output from the show ip interface command. The output displays the verification drop rate and the number of verification drops when Unicast RPF is configured for an interface. The last five lines in the following example show the output of the show ip interface command when Unicast RPF is configured:
Router# show ip interface ethernet 2/3
Ethernet2/3 is up, line protocol is up
Internet address is 10.10.5.4/16
Broadcast address is 255.255.255.255
Address determined by non-volatile memory
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is disabled
IP Flow switching is disabled
IP CEF switching is disabled
IP Null turbo vector
IP Null turbo vector
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are No CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is disabled
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled
BGP Policy Mapping is disabled
Input features: uRPF
IP verify source reachable-via RX, allow default
0 verification drops
0 suppressed verification drops
0 verification drop-rate
Router#
The following is sample output from the debug ip verify mib command. The command displays output that is useful for troubleshooting Unicast RPF notification:
Router# debug ip verify mib
01:29:45: cipUrpfScalar_get, searchType 161
01:29:45: ipurpfmib_get_scalars
01:29:45: cipUrpfScalar_get, searchType 161
01:29:45: cipUrpfScalar_get, searchType 161
01:29:45: ipurpfmib_get_scalars
01:29:45: cipUrpfScalar_get, searchType 161
01:29:45: cipUrpfScalar_get, searchType 161
01:29:45: ipurpfmib_get_scalars
01:29:45: cipUrpfScalar_get, searchType 161ipurpfmib_get_urpf_entryipurpfmib_get_urpf_entryipurpfmib_get_urpf_entryipurpfmib_get_ urpf_entry
01:29:45: cipUrpfIfMonEntry_get, searchType 161
01:29:45: ipurpfmib_get_urpf_ifmon_entry entry: ST 161, if 1, ip 1
01:29:45: cipUrpfIfMonEntry_get, searchType 161
01:29:45: ipurpfmib_get_urpf_ifmon_entry entry: ST 161, if 1, ip 1
01:29:45: cipUrpfIfMonEntry_get, searchType 161
01:29:45: ipurpfmib_get_urpf_ifmon_entry entry: ST 161, if 1, ip 1
01:29:45: cipUrpfIfMonEntry_get, searchType 161
01:29:45: ipurpfmib_get_urpf_ifmon_entry entry: ST 161, if 1, ip 1
01:29:45: cipUrpfIfMonEntry_get, searchType 161
01:29:45: ipurpfmib_get_urpf_ifmon_entry entry: ST 161, if 1, ip 1
01:29:45: cipUrpfIfMonEntry_get, searchType 161
01:29:45: ipurpfmib_get_urpf_ifmon_entry entry: ST 161, if 1, ip 1
01:29:45: cipUrpfIfMonEntry_get, searchType 161
01:29:45: ipurpfmib_get_urpf_ifmon_entry entry: ST 161, if 1, ip 1
01:29:45: cipUrpfIfMonEntry_get, searchType 161
01:29:45: ipurpfmib_get_urpf_ifmon_entry entry: ST 161, if 1, ip 1
01:29:45: cipUrpfIfMonEntry_get, searchType 161
01:29:45: ipurpfmib_get_urpf_ifmon_entry entry: ST 161, if 1, ip 1
01:29:45: cipUrpfIfMonEntry_get, searchType 161
01:29:45: ipurpfmib_get_urpf_ifmon_entry entry: ST 161, if 1, ip 1
|
|
---|---|
Cisco IOS commands |
|
Security commands |
|
Configuring Unicast RPF |
"Configuring Unicast Reverse Path Forwarding" module in the Cisco IOS Security Configuration Guide: Securing the Data Plane |
Configuring SNMP |
"Configuring SNMP Support" module in the Network Management Configuration Guide |
|
|
---|---|
CISCO-IP-URPF-MIB |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: |
|
|
---|---|
None |
— |
Table 1 lists the features in this module and provides links to specific configuration information.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.