Zte ZXR10 ZSR V2 - Chapter 21 IPv6 URPF Configuration

Chapter21
IPv6URPFConguration
TableofContents
URPFOverview.......................................................................................................21-1
ConguringIPv6URPF............................................................................................21-2
IPv6URPFCongurationInstances.........................................................................21-3
21.1URPFOverview
URPFIntroduction
UnicastReversePathForwarding(URPF)canpreventthenetworkattackbehaviorthatis
basedonsourceaddressspoong.
BycheckingthesourceIPaddressescontainedinpackets,URPFdecideswhethertrafc
isvalidandwhethertoforwardordropthepacketsaccordingtotheinterfaceonwhich
packetsarereceivedandwhethertheroutesofthesourceaddressesexistintherouting
table.
URPFisdividedintothreekinds.
lsRPF:strictURPF
llRPF:looseURPF
llnRPF:URPFignoringdefaultroute
StrictRPF
StrictRPFisaneasiermethodtoltersourceaddress.Itperformsroutinglookupbysource
addressandestimateswhethertheegressinterfaceofreturnpathisconsistentwiththe
ingressinterfaceofthepacketsarriving.Iftheyareconsistent,theforwardingcontinues.
Iftheyareinconsistent,URPFACLmatchingisconsidered.IfURPFACLmatchingisnot
performed,thenthepacketsarediscardeddirectly.Conversely,ifURPFACLmatchingis
performedandtheresultismatched,theforwardingcontinues.Iftheresultisnotmatched,
thepacketsarediscarded.
StrictRPFisonlyapplicabletoroutesymmetry.Thatis,whenthepacketsenterfrom
adirection,itsentrancepathisthesamewithitsreturnpath.However,theroutepaths
normallyareasymmetricbetweenISPs.Atthesametime,ifsomeBGPvalidnetwork
segmentaddressesarenotadvertisedoracceptedbyISPpolicy,sRPFjustlikeanACL
withincompleteconguration.Somevaliddataowwillbediscardedbecauseoflackof
informationintheforwardingtableofthelterrouter.
21-1
SJ-20140504150128-018|2014-05-10(R1.0)ZTEProprietaryandCondential