• Troubleshooting Unicast RPF on page 331
• Understanding Unicast RPF on page 19
Disabling Unicast RPF (CLI Procedure)
Unicast reverse-path forwarding (RPF) can help protect your LAN from denial-of-service
(DoS) and distributed denial-of-service (DDoS) attacks on untrusted interfaces. Unicast
RPF filters traffic with source addresses that do not use the incoming interface as the
best return path back to the source. If the network configuration changes so that an
interface that has unicast RPF enabled becomes a trusted interface or becomes
asymmetrically routed (the interface that receives a packet is not the best return path
to the packet’s source), disable unicast RPF.
To disable unicast RPF on an EX3200, EX4200, or EX4300 switch, you must delete it
from every interface on which you explicitly configured it. If you do not disable unicast
RPF on every interface on which you explicitly enabled it, it remains implicitly enabled
on all interfaces. If you attempt to delete unicast RPF from an interface on which it was
not explicitly enabled, the warning: statement not found message appears. If you do not
disable unicast RPF on every interface on which you explicitly enabled it, unicast RPF
remains implicitly enabled on all interfaces of the EX3200, EX4200, or EX4300 switch.
On EX8200, EX6200, and QFX Series switches, the switch does not apply unicast RPF
to an interface unless you explicitly enable that interface for unicast RPF.
To disable unicast RPF, delete its configuration from the interface:
[edit interfaces]
user@switch# delete ge-1/0/10 unit 0 family inet rpf-check
NOTE: On EX3200, EX4200, and EX4300 switches, if you do not disable
unicast RPF on every interface on which you explicitly enabled it, unicast RPF
remains implicitly enabled on all interfaces.
Related
Documentation
Example: Configuring Unicast RPF on an EX Series Switch•
• Verifying Unicast RPF Status on page 239
• Configuring Unicast RPF (CLI Procedure) on page 97
• Understanding Unicast RPF on page 19
99Copyright © 2015, Juniper Networks, Inc.
Chapter 2: Configuration Tasks