UCF STIG Viewer Logo

The Cisco PE switch must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces.


Finding ID Version Rule ID IA Controls Severity
V-221048 CISC-RT-000740 SV-221048r622190_rule Medium
The uRPF feature is a defense against spoofing and denial-of-service (DoS) attacks by verifying if the source address of any ingress packet is reachable. To mitigate attacks that rely on forged source addresses, all provider edge switches must enable uRPF loose mode to guarantee that all packets received from a CE switch contain source addresses that are in the route table.
Cisco IOS XE Switch RTR Security Technical Implementation Guide 2023-09-13


Check Text ( C-22763r408938_chk )
Review the switch configuration to determine if uRPF loose mode is enabled on all CE-facing interfaces.

interface GigabitEthernet0/2
no switchport
ip address x.1.12.2
ip access-group BLOCK_TO_CORE in
ip verify unicast source reachable-via any

If uRPF loose mode is not enabled on all CE-facing interfaces, this is a finding.
Fix Text (F-22752r408939_fix)
Configure uRPF loose mode on all CE-facing interfaces as shown in the example below:

SW2(config)#int SW1(config)#int g0/2
SW2(config-if)#ip verify unicast source reachable-via any