Cisco Systems 4500 Implementing Unicast RPF

32-4
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 32 Configuring Unicast Reverse Path Forwarding
About Unicast Reverse Path Forwarding
1/1. If there is a matching path, the packet is forwarded. There is no reverse entry in the routing table
that routes the customer packet back to source address 209.165.200.225 on interface Gigabit Ethernet
1/1, and so the packet is dropped.
Figure 32-2 Unicast RPF Dropping Packets That Fail Verification
Implementing Unicast RPF
Unicast RPF has several key implementation principles:
• The packet must be received at an interface that has the best return path (route) to the packet source
(a process called symmetric routing). There must be a route in the FIB matching the route to the
receiving interface. Adding a route in the FIBis done with a static route, network statement, or
dynamic routing. (ACLs permit the use of Unicast RPF when packets will arrive by specific, less
optimal asymmetric input paths.)
• IP source addresses at the receiving interface must match the routing entry for the interface.
• Unicast RPF is an input function and is applied only on the input interface of a switch at the
upstream end of a connection.
Given these implementation principles, Unicast RPF becomes a tool that network administrators can use
not only for their customers but also for their downstream network or ISP, even if the downstream
network or ISP has other connections to the Internet.
Destination address x.x.x.x
Source address 209.165.200.225
Unicast
RPF
In
Drop
Out
Routing table:
192.168.0.0 via 172.19.66.7
172.19.0.0 is directly connected, FDDI 2/0/0
CEF table:
192.168.0.0 172.19.66.7 FDDI 2/0/0
172.19.0.0 attached FDDI 2/0/0
Adjacency table:
FDDI 2/0/0 172.19.66.7 50000603E...AAAA03000800
RPF checks to see if
the reverse path for
the source address
matches the input port
If not okay, RPF
drops the packet
33403
Data IP header
Data IP header