| Unicast Reverse Path Forwarding (uRPF) provides a mechanism for IP address spoof protection. When uRPF is enabled on an interface, the router examines all packets received as input on that interface to make sure that the source address and source interface appear in the routing table and match the interface on which the packet was received. If the packet was received from one of the best reverse path routes, the packet is forwarded as normal. If there is no reverse path route on the same interface from which the packet was received, it might mean that the source address was modified. If Unicast RPF does not find a reverse path for the packet, the packet is dropped.
If internal nodes automatically configure an address based on a prefix from a bogus router advertisement a dangerous situation may develop. An internal host may contact an internal server, which would respond with a packet that could be routed outside of the network via default routing (because the routers do not recognize the destination address as an internal address).
To prevent this, filtering should be applied to network interfaces between internal host LANs and internal server LANs to ensure that source addresses have valid prefixes. |
