Cisco Nexus 3600 NX-OS - Unicast RPF Process; Global Statistics

With Unicast RPF, all equal-cost “best” return paths are considered valid, which means that Unicast RPF
works where multiple return paths exist, if each path is equal to the others in terms of the routing cost
(number of hops, weights, and so on) and as long as the route is in the FIB. Unicast RPF also functions
where Enhanced Interior Gateway Routing Protocol (EIGRP) variants are being used and unequal candidate
paths back to the source IP address exist.
Note
Unicast RPF Process
Unicast RPF has several key implementation principles:
•
The packet must be received at an interface that has the best return path (route) to the packet source (a
process called symmetric routing). There must be a route in the FIB that matches the route to the receiving
interface. Static routes, network statements, and dynamic routing add routes to the FIB.
•
IP source addresses at the receiving interface must match the routing entry for the interface.
•
Unicast RPF is an input function and is applied only on the input interface of a device at the upstream
end of a connection.
You can use Unicast RPF for downstream networks, even if the downstream network has other connections
to the Internet.
Be careful when using optional BGP attributes, such as weight and local preference, because an attacker
can modify the best path back to the source address. Modification would affect the operation of Unicast
RPF.
Caution
When a packet is received at the interface where you have configured Unicast RPF and ACLs, the Cisco
NX-OS software performs the following actions:
Procedure
Step 1
Checks the input ACLs on the inbound interface.
Step 2
Uses Unicast RPF to verify that the packet has arrived on the best return path to the source, which it does by
doing a reverse lookup in the FIB table.
Step 3
Conducts a FIB lookup for packet forwarding.
Step 4
Checks the output ACLs on the outbound interface.
Step 5
Forwards the packet.
Global Statistics
Each time the Cisco NX-OS device drops a packet at an interface due to a failed unicast RPF check, that
information is counted globally on the device on a per-forwarding engine (FE) basis. Global statistics on
Cisco Nexus 3600 NX-OS Security Configuration Guide, Release 7.x
102
Configuring Unicast RPF
Unicast RPF Process