Example: Configuring Unicast RPF (On a Switch)

This example uses two EX switches, referred to in this topic as Switch A and Switch B. Certain EX switch models allow you to configure uRPF on individual interfaces. Whereas on certain EX switch models you cannot configure individual interfaces for uRPF – the switch applies uRPF globally to all interfaces on the switch.

• Any Junos OS release for EX switches but not earlier than Junos OS Release 10.1

• Two EX switches that support uRPF configuration on individual interfaces.

Before you begin, ensure you have:

• Connected the two switches by symmetrically routed interfaces.

• Ensured that the interface on which you will configure unicast RPF is symmetrically routed. A symmetrically routed interface is an interface that uses the same route in both directions between the source and the destination. Do not enable unicast RPF on asymmetrically routed interfaces. An asymmetrically routed interface uses different paths to send and receive packets between the source and the destination.

• In this example, if you are using EX switches that apply uRPF globally to all interfaces, then ensure that all switch interfaces are symmetrically routed before you enable unicast RPF on an interface. When you enable unicast RPF on any interface, it is enabled globally on all switch interfaces. Do not enable unicast RPF on asymmetrically routed interfaces. An asymmetrically routed interface uses different paths to send and receive packets between the source and the destination.

In this example, an enterprise network's system administrator wants to protect Switch A against potential DoS and DDoS attacks from the Internet. The administrator configures unicast RPF on interface xe-0/0/4 on Switch A. Packets arriving on interface xe-0/0/4 on Switch A from the Switch B source also use incoming interface xe-0/0/4 as the best return path to send packets back to the source. In this topology, Switch A and Switch B are both connected by symmetrically routed interfaces.

• Switch A is on the edge of an enterprise network. The interface xe-0/0/4 on Switch A connects to the interface xe-0/0/5 on Switch B.

• Switch B is on the edge of the service provider network that connects the enterprise network to the Internet.

To enable unicast RPF, perform these tasks:

[edit interfaces]
set xe-0/0/4 unit 0 family inet rpf-check

[edit interfaces]
user@switch# show
xe-0/0/4 {
    unit 0 {
        family inet {
            rpf-check;
        }
    }
}

Unicast reverse-path forwarding (RPF) can help protect your LAN from denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks on untrusted interfaces. Unicast RPF filters traffic with source addresses that do not use the incoming interface as the best return path back to the source. If the network configuration changes so that an interface that has unicast RPF enabled becomes a trusted interface or becomes asymmetrically routed (the interface that receives a packet is not the best return path to the packet’s source), disable unicast RPF.

On EX switch models that allow you to configure uRPF on individual interfaces, the switch does not apply unicast RPF to an interface unless you explicitly enable that interface for unicast RPF.

To disable unicast RPF, delete its configuration from the interface:

[edit interfaces]user@switch# delete xe-0/0/4 unit 0 family inet rpf-check

user@switch> show interfaces xe-0/0/4.0 extensive
Physical interface: xe-0/0/4, Enabled, Physical link is Up
  Interface index: 147, SNMP ifIndex: 659
  Link-level type: Ethernet, MTU: 1514, LAN-PHY mode, Speed: 10Gbps, BPDU Error: None, Loop Detect PDU Error: None, Ethernet-Switching Error: None,
  MAC-REWRITE Error: None, Loopback: None, Source filtering: Disabled, Flow control: Enabled, Speed Configuration: Auto
  Device flags   : Present Running
  Interface flags: SNMP-Traps Internal: 0x4000
  Link flags     : None
  CoS queues     : 8 supported, 8 maximum usable queues
  Current address: 84:c1:c1:7b:a8:04, Hardware address: 84:c1:c1:7b:a8:04
  Last flapped   : 2023-04-04 10:34:13 PDT (00:01:29 ago)
  Input rate     : 0 bps (0 pps)
  Output rate    : 0 bps (0 pps)
  Active alarms  : None
  Active defects : None
  PCS statistics                      Seconds
    Bit errors                             2
    Errored blocks                         2
  Link Degrade :                      
    Link Monitoring                   :  Disable
  Interface transmit statistics: Disabled

  Logical interface xe-0/0/4.0 (Index 335) (SNMP ifIndex 696)
    Flags: Up SNMP-Traps 0x4004000 Encapsulation: ENET2
    Input packets : 0
    Output packets: 1
    Protocol inet, MTU: 1500
    Max nh cache: 100000, New hold nh limit: 100000, Curr nh cnt: 0, Curr new hold cnt: 0, NH drop cnt: 0
      Flags: Sendbcast-pkt-to-re, uRPF
      Addresses, Flags: Is-Preferred Is-Primary
        Destination: 10.0.1/24, Local: 10.0.1.1, Broadcast: 10.0.1.255
    Protocol multiservice, MTU: Unlimited
      Flags: Is-Primary