Help with command on PIX and router.

[johnleeee]

Id like to know what does do command ip verify reverse-path and what is difference when configured on PIX and router.

And where it is good to use this command?

thanks all in advance

rg

jl

[sachinraja]

Hi .. the command refers to the same concept in both PIX and the router. This is basically used to mitigate problems caused by malformed or spoofed Ip source addresses into a network. When applied on a router/PIX, it can discard packets that lack a verifiable source IP..

Only the packets sourced from inside the LAN are allowed back to the inside network.

Its good to use at the edge of a network, which connects to the local LAN. using it at the core will create problems, if unsymmetrical routing happens...

Go through the following URL for details about RPF;

http://www.cisco.com/en/US/tech/tk583/tk385/technologies_white_paper09186a0080174a5b.shtml

[johnleeee]

So does it mean that whan I have on inside eth. interface and on outside fasteth. interface, for.example on router and I configure on inside int. ip verify unicast reverse-path command I will check trough this command source ip address when communication starts from my LAN and in opposite communication from internet it function like with CBAC access-list.

So result will be that I dont need to use any inside or outside access-list on my inside interface.

rg

jl

[scoclayton]

All the "ip unicast reverse-path" command (and the corresponding command on the PIX) is doing, is referencing the route table and making sure that source address matches the interface where the route table says the packet should have been coming from. Or, in other words, the command denies packets on the inside interface source from address that belong on the outside interface (and vice-versa).

Does this help at all?

Scott

[johnleeee]

Scott thanks for advice,

I have only one question about ip unicast reverse-path command on PIX. I read that this command must be used with cef command. What about PIX?

rg

jl

[scoclayton]

CEF switching is only a requirement for IOS. There is no concept of CEF switching in the PIX. On the PIX, all you need to do is enable the command and you should be good to go.

Hope this helps.

Scott

[johnleeee]

Ok guy, thats enough.

jl