topic Student - Help Understanding with uRPF and IOS Firewall Usage in Network Security

Student - Help Understanding with uRPF and IOS Firewall Usage

StevenMH1982 — Tue, 12 Mar 2019 05:44:13 GMT

Hello all,

Quick question and advanced apologizes is this is the wrong place to post this. Trying to understand Unicast Reverse Path Forwarding I have to ask what is the difference using the two methods below if any? Thank you all in advance for your time to read and help a stranger out.

access-list 101 deny 10.0.0.0 0.255.255.255 any
access-list 101 deny 172.16.0.0 0.15.255.255 any
access-list 101 deny 192.168.0.0 0.0.255.255 any
access-list 101 permit ip any any

interface FastEthernet 4
Description WAN/Outside Zone
ip verify unicast source reachable-via rx 101

versus

interface FastEthernet 4
Description WAN/Outside Zone
ip access-group 101 in

This commands check the

Pranay Prasoon — Sun, 05 Apr 2015 20:22:38 GMT

This commands check the incoming packet "source ip" and matches in its routing table and sees if this network is reachable only through that interface.

Example

if you have this route in routing table

192.168.1.0/24 via gi0/0

So the traffic from 192.168.1.2 should only come from gi0/0. This is called strict mode.

Thanks for the reply. Would

StevenMH1982 — Sun, 05 Apr 2015 21:50:11 GMT

Thanks for the reply. Would not both methods (uRPF & static ACL) prevent spoofed traffic from the private IP ranges from ingress traffic to the WAN interface?

well uRPF is an intelligent

Pranay Prasoon — Sun, 05 Apr 2015 22:01:19 GMT

well uRPF is an intelligent way of avoiding spoofed traffic. Where configring static ACL is difficult unless you have idea of what all ACE you need to create. rpf feature can do it intelligently with the help of routing table. uRPF can also help in avoiding traffic loop where a route is coming back looping from a wrong interface.