Configuring The Unicast Rpf Checking Mode - Cisco 6500 Series Software Configuration Manual

Configuring Unicast Reverse Path Forwarding
This example shows how to enable self-pinging:
Router(config)# interface gigabitethernet 4/1
Router(config-if)# ip verify unicast source reachable-via any allow-self-ping
Router(config-if)# end

Configuring the Unicast RPF Checking Mode

There are two Unicast RPF checking modes:
•
•
Note The most recently configured mode is automatically applied to all ports configured for Unicast RPF
checking.
To configure Unicast RPF checking mode, perform this task:
Command
Step 1
Router(config)# interface {{vlan vlan_ID} |
1
{type slot/port} | {port-channel number}}
Step 2
Router(config-if)# ip verify unicast source
reachable-via {rx | any} [allow-default] [list]
Router(config-if)# no ip verify unicast
Step 3
Router(config-if)# exit
1. type = ethernet, fastethernet, gigabitethernet, or tengigabitethernet
When configuring the Unicast RPF checking mode, note the following syntax information:
•
•
•
•
Note When you enter the ip verify unicast source reachable-via command, the Unicast RPF checking mode
changes on all ports in the switch.
Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide—Release 12.1 E
23-20
Strict checking mode, which verifies that the source IP address exists in the FIB table and verifies
that the source IP address is reachable through the input port.
Exist-only checking mode, which only verifies that the source IP address exists in the FIB table.
Use the rx keyword to enable strict checking mode.
Use the any keyword to enable exist-only checking mode.
Use the allow-default keyword to allow use of the default route for RPF verification.
Use the list option to identify an access list.
– If the access list denies network access, spoofed packets are dropped at the port.
– If the access list permits network access, spoofed packets are forwarded to the destination
address. Forwarded packets are counted in the interface statistics.
– If the access list includes the logging action, information about the spoofed packets is sent to
the log server.
Chapter 23
Purpose
Selects an interface to configure.
Based on the input port, Unicast RPF verifies the
Note
best return path before forwarding the packet on
to the next destination.
Configures the Unicast RPF checking mode.
Reverts to the default Unicast RPF checking mode.
Exits interface configuration mode.
Configuring Network Security
78-14099-04