uRPF: Unicast Reverse Path Forwarding (uRPF) is Enabled

Information

The Unicast RPF (uRPF) helps to mitigate problems that are caused by the introduction of malformed or spoofed IP source addresses into a network by discarding IP packets that lack a verifiable IP source address. For example, a number of common types of denial-of-service (DoS) attacks, including Smurf and Tribe Flood Network (TFN), can take advantage of forged or rapidly changing source IP addresses to allow attackers to thwart efforts to locate or filter the attacks. For Internet service providers (ISPs) that provide public access, Unicast RPF deflects such attacks by forwarding only packets that have source addresses that are valid and consistent with the IP routing table. This action protects the network of the ISP, its customer, and the rest of the Internet.

Solution

Run the following command on the device to enable urpf-check: configure service ies <index> address <ip-address/mask> urpf-check <loose|strict>

See Also

https://infoproducts.alcatel-lucent.com/aces/cgi-bin/dbaccessfilename.cgi/9305050101_V1_SR-OS Security Best Practices v2.0.pdf

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5(1)

Plugin: Alcatel

Control ID: 5da346a65f1df1e213ab8fdf7968801384fa19fa754e446f632cfc3f449a319b