Zte ZXR10 8900 Series - URPF Configuration Example

Chapter17URPFConguration
Note:
Instep1,theparametersaredescribedbelow.
�StrictmeansthatifegressportfoundbysourceIPaddressis
differentfromdataingressport,itwillbediscarded;otherwise
itwillbeprocessedinprimaryway.
�LoosemeansthatifsourceIPaddresscanndroute,and
egressportandingressportofdefaultroutearecoincident,it
willbeprocessedinthenormalway,otherwiseitwillbedis-
carded.
�Loose-ingoring-default-routemeansthatifsourceIPad-
dresscanndrouteandtherouteisnotbydefault,itwillbe
processedinthenormalway.Otherwiseitwillbediscarded.
URPFConfiguration
Example
URPFnetworktopologyisshowninFigure39.
FIGURE39URPFCONFIGURATIONEXAMPLE
StrictURPFisconguredoninterfacefei_1/2onS1soastopre-
venttheusersbehindnetwork192.168.0.0/24frommaliciously
attackingnetworksbehindS1.
CongurationonS1:
ZXR10(config)#interfacefei_1/2
ZXR10(config-if)#swacvlan10
ZXR10(config-if)#ipverifystrict
ZXR10(config-if)#exit
ZXR10(config)#intvlan10
ZXR10(config-if)#ipaddress192.168.0.1255.255.255.0
CondentialandProprietaryInformationofZTECORPORATION159