System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

uRPF source validation mechanisms

Updated: September 18, 2026

Want to summarize with AI?

Introduces uRPF source validation concepts, describing validation modes, loose and strict mode behaviors, VRF-based source validation, configuration and verification procedures, compliance requirements, and default route handling for comprehensive network security.

A uRPF source validation mechanism is a network security feature that

checks whether the source IP address of a received packet is listed as reachable in the router's Forwarding Information Base (FIB)
performs a reverse path lookup in the FIB to ensure the validity of the source, and
drops packets when the source IP address is not listed in the FIB, reducing the risk of source address spoofing.

Feature history

Table 1. Feature History Table
Feature Name	Release Information	Description
URPF source validation using VRF table	Release 26.2.1	Introduced in this release on: Fixed Systems (8200 [ASIC: Q200]) Modular Systems (8000 [ASIC: Q200])(select variants only) This feature provides secure traffic validation by supporting high prefix scales and high-speed updates that exceed the capabilities of standard Access Control Lists. It implements a new loose mode Unicast Reverse Path Forwarding (URPF) by using a dedicated URPF Virtual Routing and Forwarding (VRF) table for source lookups. This process enables efficient source validation within existing platform routing limits. This feature introduces these changes: CLI: The vrf RED urpf-lookup-ipv4* and vrf RED urpf-lookup-ipv6 keywords are introduced in the vrf vrf-name command. *This feature is supported on: Cisco 8202-32FH-M 88-LC0-36FH 88-LC0-36FH-M
uRPF in Loose Mode	Release 25.4.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only) This feature is supported on: 8711-48Z-M 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
uRPF in Loose Mode	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
uRPF in Loose Mode	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
uRPF in Loose Mode	Release 7.3.15	When the source IP address of an incoming packet is not present in the Forwarding Information Base (FIB), the router considers it as an invalid packet and drops it. Use the allow-default keyword of ipv4/ipv6 verify unicast source reachable-via command and configure the default route for the interface so that the router does not drop a packet even when the source IP address is not present in the FIB. The command ipv4/ipv6 verify unicast source reachable-via is introduced.

Security behavior

Source address spoofing is a common technique used in Denial-of-Service (DoS) attacks, where forged source IP addresses make attack traffic harder to identify and trace. Attackers may change source IP addresses to avoid detection by service providers, and malware-infected hosts can use multiple forged addresses to flood a device.

uRPF improves security by validating the source IP address of each received packet. If the source is reachable according to the FIB, it is considered valid; otherwise, the router drops the packet.

uRPF validation modes

The router supports these uRPF validation modes.

Table 2. uRPF validation modes
Mode	Lookup	Packet handling	Use case
Loose mode	The router checks whether a matching FIB entry exists for the source IP address.	The router does not require the source to be learned through the same interface that received the packet.	Use in multihomed service-provider edge networks where legitimate traffic can arrive on alternate interfaces.
Strict mode	The router checks whether the receiving interface is also the interface used to reach the source address.	The router accepts packets only when the source is reachable through the receiving interface; otherwise, it drops the packet.	Use where routing is naturally or explicitly symmetric. Strict mode is supported since Cisco IOS XR Release 7.9.1.

The modes differ by whether the ingress interface must match the route back to the packet source.

Use loose mode for asymmetric paths and strict mode only where source routes are symmetric.

uRPF loose mode

A uRPF loose mode is a source validation mode that

checks whether the source IP address has a matching entry in the FIB
permits legitimate traffic that uses alternate interfaces to reach the router, and
validates the source address against the FIB without requiring an ingress-interface match.

Loose-mode packet example

In loose mode, the router receives packets with source address 203.1.113.1 from both HundredGigE0/2/0/2 and HundredGigE0/2/0/3.

When loose mode is configured on the ingress interface, the router checks only whether the source address has a matching FIB entry. The router does not drop the packet when the ingress interface is not listed in the FIB as the outgoing interface for that prefix. This feature is useful in multihomed service-provider edge networks, where legitimate traffic may use alternate paths and interfaces.

Requirement: Comply with interface and address-family configuration for loose-mode uRPF

Follow these requirements when you configure uRPF in loose mode:

Configure loose-mode uRPF only on router interfaces, subinterfaces, bundle interfaces, and bundle subinterfaces.
Configure both IPv4 and IPv6 commands for uRPF to work.
Use loose mode for deployments that can have legitimate asymmetric paths, such as multihomed service-provider edge networks.

Configure uRPF loose mode on an interface

Enable loose-mode Unicast Reverse Path Forwarding (uRPF) on router interfaces to help prevent IP spoofing while permitting asymmetric routing.

Loose-mode uRPF is typically used in multihomed service-provider edge networks, where traffic paths may be asymmetric. This configuration allows the router to check if the source address exists in the Forwarding Information Base (FIB), even if it was received on a different interface.

Procedure

Configure loose-mode uRPF for IPv4 and IPv6 on the interface.

Example:

Router(config)# interface HundredGigE 0/2/0/2
Router(config-if)# ipv4 verify unicast source reachable-via any
Router(config-if)# ipv6 verify unicast source reachable-via any
Router(config-if)# commit

Use the reachable-via any option so the router checks for a source FIB entry without requiring an ingress-interface match.

Loose-mode uRPF is now configured on the selected interface. The router will validate source addresses for both IPv4 and IPv6 against the FIB, allowing for traffic with asymmetric return paths.

Verify uRPF drop counters

Confirm that uRPF source validation is dropping packets as expected by checking the CEF drop counters.

Use the show cef drops command after configuring uRPF source validation to see per-node drop statistics.

Before you begin

Ensure you have configured uRPF on the relevant interface.

Procedure

Use the show cef drops command to display the uRPF drop counters.

Example:

Router(config-if)# show cef drops
Node: 0/0/CPU0
  Unresolved drops     packets :               0
  Unsupported drops    packets :               0
  Null0 drops          packets :               0
  No route drops       packets :               2
  No Adjacency drops   packets :               0
  Checksum error drops packets :               0
  RPF drops            packets :               1911
  RPF suppressed drops packets :               0
  RP destined drops    packets :               0
  Discard drops        packets :               0
  GRE lookup drops     packets :               0
  GRE processing drops packets :               0
  LISP punt drops      packets :               0
  LISP encap err drops packets :               0
  LISP decap err drops packets :               0
Node: 0/RP0/CPU0
  Unresolved drops     packets :               0
  Unsupported drops    packets :               0
  Null0 drops          packets :               0
  No route drops       packets :               2
  No Adjacency drops   packets :               0
  Checksum error drops packets :               0
  RPF drops            packets :               1503

The output shows RPF drops, RPF suppressed drops, and other CEF drop counters for each node.

The verification is complete when the output displays RPF drop counters for the expected nodes.

Configure default route handling for loose-mode uRPF

Configure default route handling for loose-mode uRPF to enable the use of a default route during source address verification.

Loose-mode uRPF requires the source IP address of a packet to appear in the FIB. The allow-default option enables the router to use the default route in the source IP address verification process, allowing for greater flexibility in routing.

Before you begin

Configure a default route for the interface before using the allow-default option.
Without allow-default, the router drops packets when the source address is not listed in the FIB table.
With allow-default, the router still drops packets if the default route is not configured for the interface.
On any VRF interface, loose-mode uRPF with allow-default applies to all interfaces in that router VRF.

Procedure

Configure loose-mode uRPF with default-route source verification.

Example:

Router(config)# interface HundredGigE 0/2/0/2
Router(config-if)# ipv4 verify unicast source reachable-via any allow-default
Router(config-if)# ipv6 verify unicast source reachable-via any allow-default
Router(config-if)# commit

Use the allow-default option when the default route must participate in the source IP address verification process.

Default-route handling is configured when the IPv4 and IPv6 reachable-via any allow-default commands are committed under the selected interface.

uRPF strict mode behaviors

A uRPF strict mode behavior is a source validation mechanism that

checks the source address in the Forwarding Information Base (FIB)
forwards packets arriving on the same interface the router uses to reach the packet's source address, and
drops packets that arrive on any other interface.

Table 3. Feature History Table
Feature Name	Release Information	Feature Description
uRPF in Strict Mode	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
uRPF in Strict Mode	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
uRPF in Strict Mode	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
uRPF in Strict Mode	Release 7.9.1	You can protect the router against DoS attacks with spoofed source IP addresses by enabling the Strict mode in uRPF. When this feature is enabled, the router accepts the incoming packet only if the source IP address of the packet is present in its routing table and if the source IP address of the input packet is reachable via the interface on which the packet has been received. If not, the router drops the packet.In earlier releases IOS XR supports only loose mode uRPF. This feature introduces the hw-module profile cef unipath-surpf command. This feature modifies the ipv4/ipv6 verify unicast source reachable-via command.

Use this information before enabling strict mode on supported hardware.

Additional reference information

Strict-mode uRPF is supported on select Cisco platforms, introduced across various releases with specific command changes. Platform and command support details are essential before enabling strict mode.

Use this information before enabling strict mode on supported hardware.

In a strict-mode scenario, R1 uses the interface HundredGigE0/2/0/3 as the egress path for network 203.0.113.0/24. R1 receives packets with source address 203.1.113.1 through interfaces HundredGigE0/2/0/2 and HundredGigE0/2/0/3. R1 accepts the packet received on HundredGigE0/2/0/3 because it is the correct path to the source according to the FIB. Conversely, R1 drops the packet arriving on HundredGigE0/2/0/2 because it is not the FIB route to the source. Where multiple egress interfaces exist for a network, the router checks all entries before dropping the packet.

Requirement: Follow strict-mode uRPF rules

Follow these rules when you configure uRPF in strict mode.

Configure strict mode only on router interfaces, subinterfaces, bundle interfaces, and bundle subinterfaces.
Do not configure strict mode on tunnel interfaces or BVI interfaces.
Configure both IPv4 and IPv6 traffic types for uRPF to work.
The router disables strict mode by default.
Use strict mode only where routing has natural or configured symmetry.
Avoid strict mode on internal interfaces where route asymmetry is likely.
Reload the router after executing the hw-module profile cef unipath-surpf command.
Use the allow-default option only when traffic is expected to arrive through default routes.

Configure uRPF strict mode on an interface

Enable strict-mode uRPF on the router interface to ensure packets are only accepted if they arrive through the interface used to reach the packet's source address.

Strict-mode uRPF requires symmetry between the packet's ingress interface and the route back to the source. This helps mitigate spoofed IP addresses by ensuring correct routing paths.

Before you begin

Review and follow the requirement: strict-mode uRPF rules.

Procedure

Enable the strict-mode uRPF profile and configure IPv4 and IPv6 strict source validation on the interface.

Example:

Router(config)# hw-module profile cef unipath-surpf enable
Router(config)# interface HundredGigE 0/2/0/2
Router(config-if)# ipv4 address 10.0.0.1 255.255.255.0
Router(config-if)# ipv4 verify unicast source reachable-via rx
Router(config-if)# ipv6 address 2001::1/64
Router(config-if)# ipv6 verify unicast source reachable-via rx
Router(config-if)# commit
Router(config-if)# exit
Router(config)# reload

The configuration includes the hw-module profile cef unipath-surpf enable command and a router reload.

Strict-mode uRPF is now enforced on the interface. The router only accepts packets whose source address is reachable via the same interface on which they arrive.

Verify uRPF strict mode configuration

Confirm that strict-mode uRPF is properly configured and operating as intended.

Use these commands after configuring strict mode and reloading the router to ensure source validation is active.

Before you begin

Configure strict-mode uRPF and reload the router before you verify the configuration.

Procedure

Use the show cef drops command to isplay the uRPF drop counters.

Example:

Router(config-if)# show cef drops
Node: 0/0/CPU0
  Unresolved drops     packets :               0
  Unsupported drops    packets :               0
  Null0 drops          packets :               0
  No route drops       packets :               2
  No Adjacency drops   packets :               0
  Checksum error drops packets :               0
  RPF drops            packets :               1911
  RPF suppressed drops packets :               0
  RP destined drops    packets :               0
  Discard drops        packets :               0
  GRE lookup drops     packets :               0
  GRE processing drops packets :               0
  LISP punt drops      packets :               0
  LISP encap err drops packets :               0
  LISP decap err drops packets :               0
Node: 0/RP0/CPU0
  Unresolved drops     packets :               0
  Unsupported drops    packets :               0
  Null0 drops          packets :               0
  No route drops       packets :               2
  No Adjacency drops   packets :               0
  Checksum error drops packets :               0
  RPF drops            packets :               1503

Verify that the output shows RPF drops, RPF suppressed drops, and other CEF drop counters for each node.

The strict-mode uRPF configuration is verified when the running configuration displays reachable-via rx and the CEF output displays RPF drop counters.

uRPF VRF source address validation

A uRPF VRF source address validation is a source verification feature that

uses a selected uRPF VRF table rather than the interface's own VRF
centralizes permitted source prefixes in one VRF, and
supports scalable and flexible network architectures.

Benefits

uRPF VRF source address validation provides these benefits.

Scales to hundreds of thousands of source prefixes and massive ECMP environments.
Reduces the need for complex per-interface ACLs and lowers TCAM consumption.
Simplifies management of prefix lists and source policies in large tenant environments.

Requirement: Follow uRPF VRF source validation guidelines

Follow these guidelines when you configure uRPF source address validation using a VRF table:

Use Cisco 8000 Series routers and line cards based on Cisco Silicon One Q200 ASIC systems: Cisco 8202-32FH-M, 88-LC0-36FH, and 88-LC0-36FH-M.
Use standard Border Gateway Protocol (BGP) Route Policy Language (RPL) to leak routes into the uRPF VRF.
Expect the router to perform the source lookup in the uRPF VRF only when the interface has uRPF enabled.
Use a dedicated VRF for uRPF validation.
Configure only one uRPF VRF on the system to prevent disruptions and comply with platform limitations.
Enable both IPv4 and IPv6 uRPF in the VRF, because enabling only one address family is not supported.
Enable uRPF on interfaces that face untrusted or external sources.
Verify configuration with operational commands such as show rsi vrf vrf_name .

Requirement: Follow uRPF VRF source validation restrictions

Follow these restrictions when you configure uRPF source address validation using a VRF table:

Use only one VRF for uRPF private lookups.
Do not use OpenConfig models for uRPF configuration or counters.
Do not expect drop counters at the interface level.
Import all connected interface IP addresses into the uRPF VRF.
Ensure IP addresses are present in the uRPF VRF for protocols such as BGP on uRPF-enabled connected interfaces.
Do not enable uRPF for only one address family, because the router rejects configurations that enable only one address family.

How uRPF source address validation works

uRPF source address validation centralizes permitted source prefixes in a dedicated VRF. Correct operation requires VRF selection, route leakage, and uRPF enablement on the appropriate interfaces.

Summary

The key components involved in the process are:

User: Configures the uRPF VRF, manages route imports, and enables uRPF on interfaces.
Router: Validates packet sources against the uRPF VRF and enforces forwarding or dropping as appropriate.
RSI control process: Manages VRF configurations on the Route Processor.
RSI agent: Receives VRF updates, communicates with platform layers, and notifies system clients.

This process enables selective filtering of incoming unicast traffic by validating source addresses against routes in a specific VRF.

Workflow

These stages describe how uRPF source address validation works.

The user configures the uRPF VRF, imports routes, and enables uRPF on the relevant interfaces.
The RSI control process handles the VRF configuration and assigns a table identifier.
The RSI control process communicates VRF information and necessary flags to the RSI agent.
The RSI agent notifies the FIB Platform Independent layer about required uRPF lookups.
The FIB Platform Independent layer updates the hardware to enable uRPF lookups in the specified VRF.
Standard BGP policies populate the uRPF VRF with the necessary routes.
The router validates the source address of incoming unicast packets against entries in the uRPF VRF and forwards or drops packets accordingly.

Result

uRPF source address validation using VRF tables enables dynamic, scalable, and flexible filtering of source addresses for unicast traffic.

Configure uRPF source address validation with a VRF table

Set up uRPF source address validation using a VRF table to ensure that IPv4 and IPv6 packets are checked against the designated VRF table.

This task enables source address validation for both IPv4 and IPv6 on the specified VRF by activating the uRPF lookup flags.

Before you begin

Follow the relevant requirements and restrictions for uRPF VRF source validation before starting. See:
- Requirement: Follow uRPF VRF source validation guidelines
- Requirement: Follow uRPF VRF source validation restrictions

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```
Enter configuration submode for the target VRF.
Example:
```
Router(config)# vrf RED
```
Enable IPv4 and IPv6 uRPF lookup flags.
Example:
```
Router(config-vrf)# urpf-lookup-ipv4
Router(config-vrf)# urpf-lookup-ipv6
```
Both address families must be enabled. A one-address-family configuration is not supported.
Commit the configuration.
Example:
```
Router(config-vrf)# commit
```
Verify the VRF configuration.
Example:
```
Router# show rsi vrf all
Router# show rsi vrf RED
```
Use these commands to confirm that the uRPF lookup flags are enabled for both IPv4 and IPv6.

uRPF source address validation is successfully configured when the VRF shows the IPv4 and IPv6 uRPF lookup flags in the RSI verification output.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.