Supported Platforms
Related Documentation
- M, MX, T Series
- For more detailed information about unicast RPF in general, see Configuring Unicast RPF
- MX Series
- Configuring Unicast RPF and Fail Filters in Dynamic Profiles for Subscriber Interfaces
Unicast RPF in Dynamic Profiles for Subscriber Interfaces
Unicast reverse-path forwarding (RPF) provides a way to reduce the effect of denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks on IPv4 and IPv6 interfaces. When you configure unicast RPF on an interface, it checks the packet source address. Packets that pass the check are forwarded. Packets that fail the check are dropped, or if a fail filter is configured, are passed to the filter for further evaluation.
Unicast RPF has two behavioral modes, strict and loose. When you configure unicast RPF in a dynamic profile, strict mode is the default. In strict mode, unicast RPF checks whether the source address of the incoming packet matches a prefix in the routing table, and whether the interface expects to receive a packet with this source address prefix. In loose mode, unicast RPF checks only whether the source address has a match in the routing table. It does not check whether the interface expects to receive a packet from a specific source address.
For both modes, when an incoming packet fails the unicast RPF check, the packet is not accepted on the interface. Instead, unicast RPF counts the packet and sends it to an optional fail filter, if present. The fail filter determines what further action is taken on the packet. In the absence of a fail filter, the packet is silently discarded.
Related Documentation
- M, MX, T Series
- For more detailed information about unicast RPF in general, see Configuring Unicast RPF
- MX Series
- Configuring Unicast RPF and Fail Filters in Dynamic Profiles for Subscriber Interfaces
Published: 2013-02-11
Supported Platforms
Related Documentation
- M, MX, T Series
- For more detailed information about unicast RPF in general, see Configuring Unicast RPF
- MX Series
- Configuring Unicast RPF and Fail Filters in Dynamic Profiles for Subscriber Interfaces
