Cisco Catalyst 4500 Series - Configuring Unicast Reverse Path Forwarding

CHAPTER
37-1
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
37
Configuring Unicast Reverse Path Forwarding
This chapter describes the Unicast Reverse Path Forwarding (Unicast RPF) feature. The Unicast RPF
feature helps to mitigate problems that are caused by malformed or forged IP source addresses that are
passing through a switch.
For a complete description of the Unicast RPF commands in this chapter, refer to the chapter “Unicast
Reverse Path Forwarding Commands” of the Cisco IOS Security Command Reference. To locate
documentation of other commands that appear in this chapter, use the command reference master index
or search online.
To identify the hardware platform or software image information associated with a feature, use the
Feature Navigator on Cisco.com to search for information about the feature or refer to the software
release notes for a specific release. For more information, see the “Identifying Supported Platforms”
section in the chapter “Using Cisco IOS Software.”
This chapter includes the following sections:
• About Unicast Reverse Path Forwarding, page 37-1
• Unicast RPF Configuration Tasks, page 37-9
• Monitoring and Maintaining Unicast RPF, page 37-11
• Unicast RPF Configuration Example: Inbound and Outbound Filters, page 37-12
Note For complete syntax and usage information for the switch commands used in this chapter, see the
Cisco IOS Command Reference Guides for the Catalyst 4500 Series Switch.
If a command is not in the Cisco Catalyst 4500 Series Switch Command Reference , you can locate it in
the Cisco IOS Master Command List, All Releases.
About Unicast Reverse Path Forwarding
The Unicast RPF feature helps to mitigate problems that are caused by the introduction of malformed or
forged (spoofed) IP source addresses into a network by discarding IP packets that lack a verifiable IP
source address. For example, a number of common types of denial-of-service (DoS) attacks, including
Smurf and Tribal Flood Network (TFN), can take advantage of forged or rapidly changing source IP
addresses to allow attackers to thwart efforts to locate or filter the attacks. For Internet service providers
(ISPs) that provide public access, Unicast RPF deflects such attacks by forwarding only packets that
have source addresses that are valid and consistent with the IP routing table. This action protects the
network of the ISP, its customer, and the rest of the Internet.