Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Configure Reverse Path Forwarding on Virtual Interfaces

Starting in CN2 Release 22.1 or later, Juniper Networks supports reverse path forwarding (RPF) on virtual interfaces in a Kubernetes-orchestrated environment.


Unicast reverse-path-forwarding (RPF) verifies that a packet is sent from a valid source address by performing an RPF check. RPF check is a validation tool that uses the IP routing table to verify whether the source IP address of an incoming packet is arriving from a valid path. RPF helps reduce forwarding of IP packets that might be spoofing an IP address.

When a packet arrives on an interface, RPF performs a forwarding table lookup on the packet's source IP address and checks the incoming interface. The incoming interface must match the interface on which the packet arrived. If the interface doesn't match, the vRouter drops the packet. If the packet is from a valid path, the vRouter forwards the packet to the destination address.

You can enable or disable source RPF on a per-virtual network basis. By default, RPF is disabled.

  • RPF enable: Whenever a packet reaches the interface, RPF performs a check on the packet's source IP address. All packets are dropped if the route is not learned by the vRouter. Only packets received from the MAC/IP address allocated to the workload are permitted on an interface.

  • RPF disable: Packets from any source are accepted on the interface. A forwarding table lookup is not performed on the incoming packet source IP address.

Enable RPF on a Virtual Interface

To enable RPF on a virtual interface, set the rpf variable under virtualNetworkProperties to enable. For example: