Configuring Urpf; Overview; Urpf Check Modes; Urpf Link Layer Check - HP 12500 Series Configuration Manual

Configuring URPF

Overview

Unicast Reverse Path Forwarding (URPF) protects a network against source address spoofing attacks,
such as denial of service (DoS) and distributed denial of service (DDoS) attacks.
Attackers send packets with forged source addresses to access a system that uses IP-address-based
authentication in the name of authorized users, or even the administrator. Even if the attackers cannot
receive any response packets, the attacks are still disruptive to the attacked target.
Figure 100 Attack based on source address spoofing
As shown in
source IP address 2.2.2.1, and Switch B sends response packets to IP address 2.2.2.1 (Switch C).
Consequently, both Switch B and Switch C are attacked. URPF can prevent such attacks.

URPF check modes

URPF supports two check modes: strict and loose. The switch supports the strict mode only.
Strict URPF—For a packet to pass strict URPF check, the source address and receiving interface of
•
the packet must match the destination address and output interface of a FIB entry. In some scenarios
such as asymmetrical routing, strict URPF may discard valid packets. Strict URPF is often deployed
between an ISP and the connected users.
• Loose URPF—For a packet to pass loose URPF check, the source address of the packet must match
the destination address of a FIB entry. Loose URPF can avoid discarding valid packets, but may let
go attack packets. Loose URPF is often deployed between ISPs, especially in asymmetrical routing.

URPF link layer check

Strict URPF check can perform link layer check on a packet. It uses the next hop address in the matching
FIB entry to look up the ARP table for a matching entry. If the source MAC address of the packet matches
the MAC address in the matching ARP entry, the packet passes strict URPF check.
Link layer check is applicable to the scenario where a Layer 3 Ethernet interface connects to a large
number of users.

How URPF works

URPF does not check multicast packets.
URPF works as follows:
If the source IP address of an incoming packet is found in the FIB table:
1.
Figure 100, an attacker on Switch A sends the server (Switch B) requests with a forged
288