About Unicast RPF
Unicast RPF is a network security feature that
-
discards IPv4 and IPv6 packets lacking a verifiable source address,
-
protects against attacks using forged or spoofed addresses, and
-
verifies packet sources by performing a reverse-path lookup in the routing table (FIB).
Attackers use methods like Smurf or Tribal Flood Network (TFN) to exploit forged or rapidly changing source IPv4 or IPv6 addresses, making it difficult for you to locate or filter these attacks. Enable Unicast RPF to help prevent these attacks by ensuring that only packets with valid source addresses matching the IP routing table are forwarded.
When you enable unicast RPF on an interface, the switch inspects all ingress packets. The switch confirms that the source address and interface are in the routing table and that the source matches the interface the packet arrived on. This process uses the Forwarding Information Base (FIB). Unicast RPF applies only to the ingress interface at the upstream end of a connection.
Unicast RPF verifies that any packet received has arrived on the best return path to its source by performing a reverse lookup in the FIB. If the packet comes from a valid reverse path, the switch forwards it; otherwise, the switch drops the packet to prevent attacks involving spoofed IP addresses.
 Note |
Unicast RPF is an ingress function and is applied only on the ingress interface of a switch at the upstream end of a connection. |
Note |
With unicast RPF, all equal-cost “best” return paths are considered valid. Unicast RPF works where multiple return paths exist if each path is equal to the others in routing cost (such as number of hops or weights) and the route is in the FIB. Unicast RPF also functions where Variants of Enhanced Interior Gateway Routing Protocol (EIGRP) are used, and unequal candidate paths to the source IP address may exist. |
Unicast RPF can prevent DoS attacks such as Smurf or TFN, where attackers use forged or changing source IP addresses to evade detection.
How unicast RPF works
Review these key principles for implementing unicast RPF.
-
Receive the packet at an interface that has the best return path (route) to the packet source (a process called symmetric routing). A matching route must exist in the FIB. Add routes to the FIB using static routes, network statements, or dynamic routing.
-
Ensure that the IP source addresses at the receiving interface match the routing entry for the interface.
-
Apply unicast RPF as an input function on the input interface at the upstream end of a connection.
 Caution |
Use optional BGP attributes, such as weight and local preference, with caution to prevent attackers from changing the best path back to the source address. These changes can disrupt unicast RPF. |
Summary
You can use unicast RPF for downstream networks, even if the downstream network has other connections to the Internet.
Workflow
When a packet is received at the interface where you have configured unicast RPF and ACLs, the Cisco NX-OS software performs these actions:
- Check the input ACLs on the inbound interface.
- Use unicast RPF to verify that the packet has arrived on the best return path to the source, which it does by doing a reverse lookup in the FIB table.
- Conduct a FIB lookup for packet forwarding.
- Check the output ACLs on the outbound interface.
- Forward the packet.
Feedback