SE2900: Details about URPF parameter in SET IPSPARA command

URPF Strict Check

The URPF strict check is recommended in the case of route symmetry. After the URPF strict check is enabled, packets can pass the URPF check only when the forwarding table contains the related entries, and matched interfaces exist.

If there is only one path between two network edge routers (FW), it indicates that the routes are symmetrical. In this case, using the URPF strict check can effectively ensure network security.

As shown in Figure 1, AS1, AS2, and AS3 are uni-directionally connected. Enable URPF on interface (1) and interface (2) on sysname_C to protect AS3 from source address spoofing attacks from AS1 and AS2.

Assume that PC in AS1 generates a packet with the pseudo source IP address 10.2.2.2 and sends the packet to the Server in AS3. After sysname_C receives this packet, it checks the inbound interface and source IP address of the packet, and determines that according to the inbound interface and source IP address, the packet with the source address 10.2.2.2 must enter the FW through interface (2) rather than interface (1). sysname_C then considers the packet as a pseudo packet and discards it.

The packet sent from AS2 to the Server is forwarded normally after passing through the URPF check.

Figure 1 URPF applied on a single-homed client

URPF Loose Check

If route symmetry is not available, use the URPF loose check. The URPF check does not check whether packets enter the FW through the matched inbound interfaces. Packets can pass the loose check as long as there is a route to the source IP address.

Route symmetry cannot be guaranteed in two situations: single-homed client with a single ISP and multi-homed client with several ISPs.

• Multi-homed client with a single ISP

  As shown in Figure 2, multiple connections are set up between Enterprise and ISP to ensure reliability. In this case, route symmetry between the Enterprise and the two ISP FWs cannot be ensured. Hence, you must use the URPF loose check.

  URPF loose check provides high security. When URPF loose check is enabled on interface (1) of FW C, and a packet arrives at FW C through FW A, the packet is not discarded if FW C identifies that there is a route destined for the source IP address of the packet on FW C; the packet is discarded if FW C identifies that there is no route destined for the source IP address of the packet on FW C.

  Figure 2 URPF applied on a single-homed client with a single ISP
  
  

• Multi-homed client with several ISPs

  As shown in Figure 3, Enterprise is connected to several ISPs. Hence, route symmetry between the Enterprise and the two ISP FWs cannot be ensured. Here, you must use the URPF loose check.

  Figure 3 URPF applied on a multi-homed client with several ISPs
  
  

• In addition, URPF has the following features:

  • You can also specify a few source addresses in the ACL to allow packets with these addresses to pass the URPF check in any situation. That is, FW supports specifying the packets without being discarded by the URPF check through ACL

  • If FWs of several users share only one default route to the ISP FW, you must configure default routes to ensure the FWs to pass the check.