close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Port Security
- play_arrow Port Security Overview
  - Overview of Port Security
play_arrow IPSec
- play_arrow Understanding IPsec and Security Associations
- play_arrow IPsec Configurations and Examples
- play_arrow Configuring IPsec Security Associations
- play_arrow Using Digital Certificates for IPsec
- play_arrow Additional IPsec Options
- play_arrow Configuring IPsec Dynamic Endpoints
- play_arrow Additional ES and AS PIC Configuration Examples
play_arrow Digital Certificates
- play_arrow Configuring Digital Certificates
- play_arrow Configuring SSH and SSL Router Access
play_arrow Trusted Platform Module
- Trusted Platform Module Overview
play_arrow MACsec
- play_arrow Understanding MACsec
  - Understanding Media Access Control Security (MACsec)
  - Media Access Control Security (MACsec) over WAN
- play_arrow MACsec Examples
play_arrow MAC Limiting and Move Limiting
- play_arrow MAC Limiting and Move Limiting Configurations and Examples
play_arrow DHCP Protection
play_arrow IP Source Guard
- play_arrow Understanding IP Source Guard
- play_arrow IP Source Guard Examples
play_arrow IPv6 Access Security
- play_arrow Neighbor Discovery Protocol
  - IPv6 Neighbor Discovery Inspection
- play_arrow SLAAC Snooping
  - IPv6 Stateless Address Auto-configuration (SLAAC) Snooping
- play_arrow Router Advertisement Guard
play_arrow Control Plane Distributed Denial-of-Service (DDoS) Protection and Flow Detection
- play_arrow Control Plane DDoS Protection
- play_arrow Flow Detection and Culprit Flows
play_arrow Unicast Forwarding
- play_arrow Unicast Reverse Path Forwarding
- play_arrow Unknown Unicast Forwarding
  - Understanding and Preventing Unknown Unicast Forwarding
play_arrow Storm Control
- play_arrow Understanding and Using Storm Control
play_arrow Malware Protection
- play_arrow Juniper Malware Removal Tool
  - Juniper Malware Removal Tool
  - How to use the Juniper Malware Removal Tool
play_arrow Configuration Statements and Operational Commands
- Security Services Configuration Statements
- Junos CLI Reference Overview

list Table of Contents

English

Example: Configuring Unicast RPF (On a Router)

date_range 24-Nov-23

arrow_backward

arrow_forward

This example shows how to help defend ingress interfaces against denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks by configuring unicast RPF on a customer-edge interface to filter incoming traffic.

Requirements

No special configuration beyond device initialization is required.

Overview

In this example, Device A is using OSPF to advertise a prefix for the link that connects to Device D. Device B has unicast RPF configured. OSPF is enabled on the links between Device B and Device C and the links between Device A and Device C, but not on the links between Device A and Device B. Therefore, Device B learns about the route to Device D through Device C.

If ingress filtering is used in an environment where DHCP or BOOTP is used, it should be ensured that the packets with a source address of 0.0.0.0 and a destination address of 255.255.255.255 are allowed to reach the relay agent in routers when appropriate.

This example also includes a fail filter. When a packet fails the unicast RPF check, the fail filter is evaluated to determine if the packet should be accepted anyway. The fail filter in this example allows Device B’s interfaces to accept Dynamic Host Configuration Protocol (DHCP) packets. The filter accepts all packets with a source address of 0.0.0.0 and a destination address of 255.255.255.255.

Topology

Figure 1 shows the sample network.

Figure 1: Unicast RPF Sample Topoolgy

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Device A

content_copy zoom_out_map
set interfaces fe-1/2/0 unit 1 family inet address 10.0.0.1/30
set interfaces fe-0/0/2 unit 5 family inet address 10.0.0.5/30
set interfaces fe-0/0/1 unit 17 family inet address 10.0.0.17/30
set interfaces fe-0/1/1 unit 25 family inet address 10.0.0.25/30
set interfaces fe-1/1/1 unit 29 family inet address 10.0.0.29/30
set protocols ospf export send-direct
set protocols ospf area 0.0.0.0 interface fe-0/1/1.25
set protocols ospf area 0.0.0.0 interface fe-1/1/1.29
set policy-options policy-statement send-direct from protocol direct
set policy-options policy-statement send-direct from route-filter 10.0.0.16/30 exact
set policy-options policy-statement send-direct then accept

Device B

content_copy zoom_out_map
set interfaces fe-1/2/0 unit 2 family inet rpf-check fail-filter rpf-special-case-dhcp
set interfaces fe-1/2/0 unit 2 family inet address 10.0.0.2/30
set interfaces fe-1/1/1 unit 6 family inet rpf-check fail-filter rpf-special-case-dhcp 
set interfaces fe-1/1/1 unit 6 family inet address 10.0.0.6/30
set interfaces fe-0/1/1 unit 9 family inet rpf-check fail-filter rpf-special-case-dhcp 
set interfaces fe-0/1/1 unit 9 family inet address 10.0.0.9/30
set interfaces fe-0/1/0 unit 13 family inet rpf-check fail-filter rpf-special-case-dhcp 
set interfaces fe-0/1/0 unit 13 family inet address 10.0.0.13/30
set protocols ospf area 0.0.0.0 interface fe-0/1/1.9
set protocols ospf area 0.0.0.0 interface fe-0/1/0.13
set routing-options forwarding-table unicast-reverse-path active-paths
set firewall filter rpf-special-case-dhcp term allow-dhcp from source-address 0.0.0.0/32 
set firewall filter rpf-special-case-dhcp term allow-dhcp from destination-address 255.255.255.255/32
set firewall filter rpf-special-case-dhcp term allow-dhcp then count rpf-dhcp-traffic 
set firewall filter rpf-special-case-dhcp term allow-dhcp then accept 
set firewall filter rpf-special-case-dhcp term default then log 
set firewall filter rpf-special-case-dhcp term default then reject

Device C

content_copy zoom_out_map
set interfaces fe-1/2/0 unit 10 family inet address 10.0.0.10/30
set interfaces fe-0/0/2 unit 14 family inet address 10.0.0.14/30
set interfaces fe-1/0/2 unit 21 family inet address 10.0.0.21/30
set interfaces fe-1/2/2 unit 26 family inet address 10.0.0.26/30
set interfaces fe-1/2/1 unit 30 family inet address 10.0.0.30/30
set protocols ospf area 0.0.0.0 interface fe-1/2/0.10
set protocols ospf area 0.0.0.0 interface fe-0/0/2.14
set protocols ospf area 0.0.0.0 interface fe-1/2/2.26
set protocols ospf area 0.0.0.0 interface fe-1/2/1.30

Device D

content_copy zoom_out_map
set interfaces fe-1/2/0 unit 18 family inet address 10.0.0.18/30

Device E

content_copy zoom_out_map
set interfaces fe-1/2/0 unit 22 family inet address 10.0.0.22/30

Configuring Device A

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure Device A:

Configure the interfaces.

content_copy zoom_out_map
[edit interfaces]
user@A# set fe-1/2/0 unit 1 family inet address 10.0.0.1/30
user@A# set fe-0/0/2 unit 5 family inet address 10.0.0.5/30
user@A# set fe-0/0/1 unit 17 family inet address 10.0.0.17/30
user@A# set fe-0/1/1 unit 25 family inet address 10.0.0.25/30
user@A# set fe-1/1/1 unit 29 family inet address 10.0.0.29/30

Configure OSPF.

content_copy zoom_out_map
[edit protocols ospf]
user@A# set export send-direct
user@A# set area 0.0.0.0 interface fe-0/1/1.25
user@A# set area 0.0.0.0 interface fe-1/1/1.29

Configure the routing policy.

content_copy zoom_out_map
[edit policy-options policy-statement send-direct]
user@A# set from protocol direct
user@A# set from route-filter 10.0.0.16/30 exact
user@A# set then accept

If you are done configuring Device A, commit the configuration.
```
[edit]
user@A# commit
```

Configuring Device B

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure Device B:

Configure the interfaces.

content_copy zoom_out_map
[edit interfaces]
user@B# set fe-1/2/0 unit 2 family inet address 10.0.0.2/30
user@B# set fe-1/1/1 unit 6 family inet address 10.0.0.6/30
user@B# set fe-0/1/1 unit 9 family inet address 10.0.0.9/30
user@B# set fe-0/1/0 unit 13 family inet address 10.0.0.13/30

Configure OSPF.

content_copy zoom_out_map
[edit protocols ospf area 0.0.0.0]
user@B# set interface fe-0/1/1.9
user@B# set interface fe-0/1/0.13

Configure unicast RPF, and apply the optional fail filter.

content_copy zoom_out_map
[edit interfaces]
user@B# set fe-1/2/0 unit 2 family inet rpf-check fail-filter rpf-special-case-dhcp 
user@B# set fe-1/1/1 unit 6 family inet rpf-check fail-filter rpf-special-case-dhcp 
user@B# set fe-0/1/1 unit 9 family inet rpf-check fail-filter rpf-special-case-dhcp 
user@B# set fe-0/1/0 unit 13 family inet rpf-check fail-filter rpf-special-case-dhcp 

(Optional) Configure the fail filter that gets evaluated if a packet fails the RPF check.

content_copy zoom_out_map
[edit firewall filter rpf-special-case-dhcp]
user@B# set term allow-dhcp from source-address 0.0.0.0/32 
user@B# set term allow-dhcp from destination-address 255.255.255.255/32
user@B# set term allow-dhcp then count rpf-dhcp-traffic 
user@B# set term allow-dhcp then accept 
user@B# set term default then log 
user@B# set term default then reject

(Optional) Configure only active paths to be considered in the RPF check.

This is the default behavior.
```
[edit routing-options forwarding-table]
user@B# set unicast-reverse-path active-paths
```
If you are done configuring Device B, commit the configuration.
```
[edit]
user@B# commit
```

Results

Confirm your configuration by issuing the show firewall, show interfaces, show protocols, show routing-options, and show policy-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Device A

content_copy zoom_out_map
user@A# show interfaces
fe-1/2/0 {
    unit 1 {
        family inet {
            address 10.0.0.1/30;
        }
    }
}
fe-0/0/2 {
    unit 5 {
        family inet {
            address 10.0.0.5/30;
        }
    }
}
fe-0/0/1 {
    unit 17 {
        family inet {
            address 10.0.0.17/30;
        }
    }
}
fe-0/1/1 {
    unit 25 {
        family inet {
            address 10.0.0.25/30;
        }
    }
}
fe-1/1/1 {
    unit 29 {
        family inet {
            address 10.0.0.29/30;
        }
    }
}

content_copy zoom_out_map
user@A# show protocols
ospf {
    export send-direct;
    area 0.0.0.0 {
        interface fe-0/1/1.25;
        interface fe-1/1/1.29;
    }
}

content_copy zoom_out_map
user@A# show policy-options
policy-statement send-direct {
    from {
        protocol direct;
        route-filter 10.0.0.16/30 exact;
    }
    then accept;
}

Device B

content_copy zoom_out_map
user@B# show firewall
filter rpf-special-case-dhcp {
    term allow-dhcp {
        from {
            source-address {
                0.0.0.0/32;
            }
            destination-address {
                255.255.255.255/32;
            }
        }
        then {
            count rpf-dhcp-traffic;
            accept;
        }
    }
    term default {
        then {
            log;
            reject;
        }
    }
}
user@B# show interfaces
fe-1/2/0 {
    unit 2 {
        family inet {
            rpf-check fail-filter rpf-special-case-dhcp;
            address 10.0.0.2/30;
        }
    }
}
fe-1/1/1 {
    unit 6 {
        family inet {
            rpf-check fail-filter rpf-special-case-dhcp;
            address 10.0.0.6/30;
        }
    }
}
fe-0/1/1 {
    unit 9 {
        family inet {
            rpf-check fail-filter rpf-special-case-dhcp;
            address 10.0.0.9/30;
        }
    }
}
fe-0/1/0 {
    unit 13 {
        family inet {
            rpf-check fail-filter rpf-special-case-dhcp;
            address 10.0.0.13/30;
        }
    }
}

content_copy zoom_out_map
user@B# show protocols
ospf {
    area 0.0.0.0 {
        interface fe-0/1/1.9;
        interface fe-0/1/0.13;
    }
}

content_copy zoom_out_map
user@B# show routing-options
forwarding-table {
    unicast-reverse-path active-paths;
}

Enter the configurations on Device C, Device D, and Device E, as shown in CLI Quick Configuration.

Verification

Confirm that the configuration is working properly.

Confirm That Unicast RPF Is Enabled
Confirm That the Source Addresses Are Blocked
Confirm That the Source Addresses Are Unblocked

Confirm That Unicast RPF Is Enabled

Purpose
Action
Meaning

Purpose

Make sure that the interfaces on Device B have unicast RPF enabled.

Action

content_copy zoom_out_map
user@B> show interfaces fe-0/1/0.13 extensive
 Logical interface fe-0/1/0.13 (Index 73) (SNMP ifIndex 553) (Generation 208)
    Flags: SNMP-Traps 0x4000 Encapsulation: ENET2
    Traffic statistics:
     Input  bytes  :               999390
     Output bytes  :              1230122
     Input  packets:                12563
     Output packets:                12613
    Local statistics:
     Input  bytes  :               998994
     Output bytes  :              1230122
     Input  packets:                12563
     Output packets:                12613
    Transit statistics:
     Input  bytes  :                  396                    0 bps
     Output bytes  :                    0                    0 bps
     Input  packets:                    0                    0 pps
     Output packets:                    0                    0 pps
    Protocol inet, MTU: 1500, Generation: 289, Route table: 22
      Flags: Sendbcast-pkt-to-re, uRPF
      RPF Failures: Packets: 0, Bytes: 0
      Addresses, Flags: Is-Preferred Is-Primary
        Destination: 10.0.0.12/30, Local: 10.0.0.13, Broadcast: 10.0.0.15, Generation: 241

Meaning

The uRPF flag confirms that unicast RPF is enabled on this interface.

Confirm That the Source Addresses Are Blocked

Purpose
Action
Meaning

Purpose

Use the ping command to make sure that Device B blocks traffic from unexpected source addresses.

Action

From Device A, ping Device B’s interfaces, using 10.0.0.17 as the source address.

content_copy zoom_out_map
user@A> ping 10.0.0.6 source 10.0.0.17
PING 10.0.0.6 (10.0.0.6): 56 data bytes
^C
--- 10.0.0.6 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss

Meaning

As expected, the ping operation fails.

Confirm That the Source Addresses Are Unblocked

Purpose
Action
Meaning

Purpose

Use the ping command to make sure that Device B does not block traffic when the RPF check is deactivated.

Action

Deactivate the RPF check on one of the interfaces.
Rerun the ping operation.

content_copy zoom_out_map
user@B> deactivate interfaces fe-1/1/1.6 family inet rpf-check

user@A> ping 10.0.0.6 source 10.0.0.17
PING 10.0.0.2 (10.0.0.2): 56 data bytes
64 bytes from 10.0.0.2: icmp_seq=0 ttl=63 time=1.316 ms
64 bytes from 10.0.0.2: icmp_seq=1 ttl=63 time=1.263 ms
^C
--- 10.0.0.2 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.263/1.289/1.316/0.027 ms

Meaning

As expected, the ping operation succeeds.

arrow_backward PREVIOUS Example: Configuring Unicast RPF (On a Switch)

NEXT arrow_forward Understanding and Preventing Unknown Unicast Forwarding

Security Services Administration Guide

ON THIS PAGE

Example: Configuring Unicast RPF (On a Router)

Requirements

Overview

Topology

Configuration

CLI Quick Configuration

Configuring Device A

Step-by-Step Procedure

Configuring Device B

Step-by-Step Procedure

Results

Verification

Confirm That Unicast RPF Is Enabled

Purpose

Action

Meaning

Confirm That the Source Addresses Are Blocked

Purpose

Action

Meaning

Confirm That the Source Addresses Are Unblocked

Purpose

Action

Meaning

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry