ON THIS PAGE
Example: Configuring Unicast RPF (On a Router)
This example shows how to help defend ingress interfaces against denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks by configuring unicast RPF on a customer-edge interface to filter incoming traffic.
Requirements
No special configuration beyond device initialization is required.
Overview
In this example, Device A is using OSPF to advertise a prefix for the link that connects to Device D. Device B has unicast RPF configured. OSPF is enabled on the links between Device B and Device C and the links between Device A and Device C, but not on the links between Device A and Device B. Therefore, Device B learns about the route to Device D through Device C.
If ingress filtering is used in an environment where DHCP or BOOTP is used, it should be ensured that the packets with a source address of 0.0.0.0 and a destination address of 255.255.255.255 are allowed to reach the relay agent in routers when appropriate.
This example also includes a fail filter. When a packet fails the unicast RPF check, the fail filter is evaluated to determine if the packet should be accepted anyway. The fail filter in this example allows Device B’s interfaces to accept Dynamic Host Configuration Protocol (DHCP) packets. The filter accepts all packets with a source address of 0.0.0.0 and a destination address of 255.255.255.255.
Figure 1 shows the sample network.
Configuration
CLI Quick Configuration
To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.
Device A
Device B
Device C
Device D
Device E
Configuring Device A
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.
To configure Device A:
- Configure the interfaces.[edit interfaces]user@A# set fe-1/2/0 unit 1 family inet address 10.0.0.1/30user@A# set fe-0/0/2 unit 5 family inet address 10.0.0.5/30user@A# set fe-0/0/1 unit 17 family inet address 10.0.0.17/30user@A# set fe-0/1/1 unit 25 family inet address 10.0.0.25/30user@A# set fe-1/1/1 unit 29 family inet address 10.0.0.29/30
- Configure OSPF.[edit protocols ospf]user@A# set export send-directuser@A# set area 0.0.0.0 interface fe-0/1/1.25user@A# set area 0.0.0.0 interface fe-1/1/1.29
- Configure the routing policy.[edit policy-options policy-statement send-direct]user@A# set from protocol directuser@A# set from route-filter 10.0.0.16/30 exactuser@A# set then accept
- If you are done configuring Device A, commit the configuration.[edit]user@A# commit
Configuring Device B
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.
To configure Device B:
- Configure the interfaces.[edit interfaces]user@B# set fe-1/2/0 unit 2 family inet address 10.0.0.2/30user@B# set fe-1/1/1 unit 6 family inet address 10.0.0.6/30user@B# set fe-0/1/1 unit 9 family inet address 10.0.0.9/30user@B# set fe-0/1/0 unit 13 family inet address 10.0.0.13/30
- Configure OSPF.[edit protocols ospf area 0.0.0.0]user@B# set interface fe-0/1/1.9user@B# set interface fe-0/1/0.13
- Configure unicast RPF, and apply the optional fail filter.[edit interfaces]user@B# set fe-1/2/0 unit 2 family inet rpf-check fail-filter rpf-special-case-dhcpuser@B# set fe-1/1/1 unit 6 family inet rpf-check fail-filter rpf-special-case-dhcpuser@B# set fe-0/1/1 unit 9 family inet rpf-check fail-filter rpf-special-case-dhcpuser@B# set fe-0/1/0 unit 13 family inet rpf-check fail-filter rpf-special-case-dhcp
- (Optional) Configure the fail filter that gets evaluated
if a packet fails the RPF check.[edit firewall filter rpf-special-case-dhcp]user@B# set term allow-dhcp from source-address 0.0.0.0/32user@B# set term allow-dhcp from destination-address 255.255.255.255/32user@B# set term allow-dhcp then count rpf-dhcp-trafficuser@B# set term allow-dhcp then acceptuser@B# set term default then loguser@B# set term default then reject
- (Optional) Configure only active paths to be considered
in the RPF check.
This is the default behavior.
[edit routing-options forwarding-table]user@B# set unicast-reverse-path active-paths - If you are done configuring Device B, commit the configuration.[edit]user@B# commit
Results
Confirm your configuration by issuing the show firewall, show interfaces, show protocols, show routing-options, and show policy-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.
Device A
Device B
Enter the configurations on Device C, Device D, and Device E, as shown in CLI Quick Configuration.
Verification
Confirm that the configuration is working properly.
Confirm That Unicast RPF Is Enabled
Purpose
Make sure that the interfaces on Device B have unicast RPF enabled.
Action
user@B> show interfaces fe-0/1/0.13 extensive Logical interface fe-0/1/0.13 (Index 73) (SNMP ifIndex 553) (Generation 208)
Flags: SNMP-Traps 0x4000 Encapsulation: ENET2
Traffic statistics:
Input bytes : 999390
Output bytes : 1230122
Input packets: 12563
Output packets: 12613
Local statistics:
Input bytes : 998994
Output bytes : 1230122
Input packets: 12563
Output packets: 12613
Transit statistics:
Input bytes : 396 0 bps
Output bytes : 0 0 bps
Input packets: 0 0 pps
Output packets: 0 0 pps
Protocol inet, MTU: 1500, Generation: 289, Route table: 22
Flags: Sendbcast-pkt-to-re, uRPF
RPF Failures: Packets: 0, Bytes: 0
Addresses, Flags: Is-Preferred Is-Primary
Destination: 10.0.0.12/30, Local: 10.0.0.13, Broadcast: 10.0.0.15, Generation: 241Meaning
The uRPF flag confirms that unicast RPF is enabled on this interface.
Confirm That the Source Addresses Are Blocked
Purpose
Use the ping command to make sure that Device B blocks traffic from unexpected source addresses.
Action
From Device A, ping Device B’s interfaces, using 10.0.0.17 as the source address.
user@A> ping 10.0.0.6 source 10.0.0.17PING 10.0.0.6 (10.0.0.6): 56 data bytes ^C --- 10.0.0.6 ping statistics --- 3 packets transmitted, 0 packets received, 100% packet loss
Meaning
As expected, the ping operation fails.
Confirm That the Source Addresses Are Unblocked
Purpose
Use the ping command to make sure that Device B does not block traffic when the RPF check is deactivated.
Action
Deactivate the RPF check on one of the interfaces.
Rerun the ping operation.
user@B> deactivate interfaces fe-1/1/1.6 family
inet rpf-checkuser@A> ping 10.0.0.6 source 10.0.0.17PING 10.0.0.2 (10.0.0.2): 56 data bytes 64 bytes from 10.0.0.2: icmp_seq=0 ttl=63 time=1.316 ms 64 bytes from 10.0.0.2: icmp_seq=1 ttl=63 time=1.263 ms ^C --- 10.0.0.2 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.263/1.289/1.316/0.027 ms
Meaning
As expected, the ping operation succeeds.