Understanding URPF (Tutorial)

Category: , , By Barooq
.
.

Unicast Reverse Path Forwarding is a small security feature
When configured on an interface, the router checks the incoming packet’s source address with its routing table. If the incoming packet’s source is reachable via the same interface it was received on, the packet is allowed. URPF provides protection again spoofed packets with unverifiable source.
Though basically a single line command, URPF can be a little confusing when used with access-list feature if order of operation is not understood completely.
We’ll use this simple topology to demonstrate URFP.





R1 and R2 are connected through frame-relay and a Ethernet connection.
We test our basic connectivity.

R2#ping 150.1.12.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 150.1.12.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 44/93/192 ms

R1#ping 150.1.12.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 150.1.12.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/45/84 ms

R1#ping 150.1.21.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 150.1.21.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/54/100 ms


All right we have reachability on both Ethernet and frame relay interfaces.
In order to demonstrate URPF we use two static routes on R1 and R2.
R1 uses frame-relay to reach R2’s loop back (2.2.2.2/24) and R2 user Ethernet to reach R1’s Loopback (1.1.1.1/24)

R1(config)#ip route 2.2.2.0 255.255.255.0 150.1.12.2
R2(config)#ip route 1.1.1.0 255.255.255.0 150.1.21.1


Without URPF, we should be able to ping R2’s loopback from R1’s loopback.

R1#ping 2.2.2.2 source lo 0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/48/80 ms



Now we enable URPF on frame-relay interface on R2.
Now when the incoming packet arrives at the frame interface, R2 checks the source address (1.1.1.1/24) in its routing table.
Since the interface used to reach this address is Ethernet0/0 , URPF checks fail and ping is not successful.

!
interface S1/0
ip address 150.1.12.2 255.255.255.0
ip verify unicast reverse-path

R1#ping 2.2.2.2 source lo 0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
.....
Success rate is 0 percent (0/5)



All right!
This was the most simple part.
Now we use URPF with an access-list.

Understanding URPF Order of Operation:

Here we have to understand the order of operations.

1) When packet arrives at the interface, URPF check is done. If the check is successful, the packet is transmitted, and ACL doesn’t come into play
2) If the check is failed, ACL is consulted. Traffic is allowed or denied based on ACL entries.
3) The thing to understand here is that an ACL with deny any any will not mean that all traffic is denied. It won’t come into play unless the URPF check is failed. If URPF check is successful all traffic is allowed. If it is failed then ACL is checked an traffic is allowed or denied based on the ACL.

R2:
!
interface Serial1/0
ip address 150.1.12.2 255.255.255.
ip verify unicast reverse-path 101

access-list 101 permit tcp any any
access-list 101 deny ip any any log-input


Here we are allowing the TCP traffic and denying all other traffic in ACL.
It means that a telnet sourced from the LoopBack 0 of R1 to LoopBack 0 of R2 will be successful, but all other traffic will be denied.

From R1:
R1#telnet 2.2.2.2 /source-interface loopback 0
Trying 2.2.2.2 ... Open


Password required, but none set

[Connection to 2.2.2.2 closed by foreign host]

Success rate is 0 percent (0/5)
R1#ping 2.2.2.2 source lo 0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
.....
Success rate is 0 percent (0/5)



Below is the log generated by ACL.

*Mar 1 00:16:40.171: %SEC-6-IPACCESSLOGDP: list 101 denied icmp 1.1.1.1 (Serial1/0 ) -> 2.2.2.2 (0/0),

Now lets ping the loopback with source frame-relay interface.

R1#ping 2.2.2.2 source S1/0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 150.1.12.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/48/80 ms


As you can see that though ACL is denying all ICMP traffic our ping is successful.
For the simple reason that ACL won’t be checked until URPF check is failed. And in the above case, it’s successful.


Now lets change the ACL.
Now our intention is to allow HTTP traffic between the loopbacks as well as ICMP traffic and deny all other traffic.

R2:
access-list 101 permit tcp any any eq www
access-list 101 permit icmp any any
access-list 101 deny ip any any log-input


We’ll be able to ping or telnet at port 80 but regular telnet will fail

R1#ping 2.2.2.2 source lo 0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/57/80 ms
R1#telnet 2.2.2.2 80 /source-interface loopback 0
Trying 2.2.2.2, 80 ... Open


R1#telnet 2.2.2.2 /source-interface loopback 0
Trying 2.2.2.2 ...
% Connection timed out; remote host not responding

R2: (:Log)
*Mar 1 00:20:18.895: %SEC-6-IPACCESSLOGP: list 101 denied tcp 1.1.1.1(35617) (S
erial1/0 ) -> 2.2.2.2(23), 1 packet



Well thats about it for URPF.
In lab exam if the feature shows up, be careful, as it can break connectivity if routers have asymmetrical routing.
Asymmetrical routing is not a problem in LAB generally as long as we have connectivity, but with URPF enabled, asymmetrical routing will break connectivity.
In that case,we can either tune unicast routing table or use the access-list with URPF to allow for connectivity.
 

19 comments so far.

  1. MDownIPexpert July 2, 2008 at 11:33 AM
    Hello,

    I've been reading your blog for some time now and wanted to discuss a couple of things with you regarding it. If you could, please email me at your convenience, it would be appreciated. Thank you!!!

    Mike
  2. Anonymous November 22, 2009 at 6:40 AM
    Hello all
    celexa pills
    The patients suffering from depression are normally recommended to prefer Celexa.
    [url=http://www.bestofdefleppard.com/]cheap celexa[/url]

    Celexa is an antidepressant that works by affecting the neurotransmitters, which actually are the chemicals within the human’s brain.
    http://www.bestofdefleppard.com/ - celexa cost
    These chemicals are produced and released by nerves in brain and they can be considered as a communication track of the brain.
  3. Anonymous February 24, 2010 at 5:01 AM
    http://markonzo.edu http://aviary.com/artists/Zyprexa http://www.ecometro.com/Community/members/ceftin-oral-tablet.aspx http://aviary.com/artists/Atenolol-oral http://profiles.friendster.com/levaquin#moreabout noiseconcern winz http://profiles.friendster.com/cleocin#moreabout http://profiles.friendster.com/nolvadex#moreabout http://profiles.friendster.com/lexapro#moreabout appeasement
  4. Anonymous March 21, 2010 at 3:59 PM
    Hey,

    I keep coming to this website[url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips].[/url]ccie-chronicles.blogspot.com really contains lot of useful information. Do you pay attention towards your health?. In plain english I must warn you that, you are not serious about your health. Recent Scientific Research displays that closely 70% of all USA grownups are either obese or overweight[url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips].[/url] Therefore if you're one of these people, you're not alone. Its true that we all can't be like Brad Pitt, Angelina Jolie, Megan Fox, and have sexy and perfect six pack abs. Now next question is how you can achive quick weight loss? You can easily lose with with little effort. If you improve some of your daily diet habbits then, its like piece of cake to quickly lose weight.

    About me: I am webmaster of [url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips]Quick weight loss tips[/url]. I am also health trainer who can help you lose weight quickly. If you do not want to go under hard training program than you may also try [url=http://www.weightrapidloss.com/acai-berry-for-quick-weight-loss]Acai Berry[/url] or [url=http://www.weightrapidloss.com/colon-cleanse-for-weight-loss]Colon Cleansing[/url] for fast weight loss.
  5. ccie training in india October 20, 2010 at 2:26 AM
    this is the best blog for ccie lab preparation.
    thanks
  6. Anonymous November 25, 2012 at 11:05 PM
    [url=http://howtobuyclomidwithoutprescription.com] Buy Clomid online no prescription[/url]

    http://howtobuyclomidwithoutprescription.com


    purchase Clomid online
  7. Anonymous November 26, 2012 at 10:38 PM
    [url=http://buyerlevitra20mgimpotence.com] [img]http://buyerlevitra20mgimpotence.com/levitra.gif[/img]
    buyerlevitra20mgimpotence.com[/url]

    http://buyerlevitra20mgimpotence.com


    cialis vs levitra vs viagra which one is better
    tadalafil
    sildenafil side effects women
    sildenafil citrate tablets 100mg - sildenafil citrate tablets 100mg:
    sildenafil 100mg and dapoxetine 60mg - sildenafil 100mg and dapoxetine 60mg:
    sildenafil generico
    tadalafil 20mg review
    sildenafil soft tablets 100mg
    tadacip 20 mg wikipedia - tadacip 20 mg wikipedia:
    adcirca price - adcirca price:
    levitra online canada no prescription
    sildenafil citrate for women in india
    tadalafil best price uk - tadalafil best price uk:
    purchase levitra online no prescription
    buy vardenafil generic



    Levitra 20mg
  8. Anonymous January 30, 2013 at 3:33 PM
    Avoidance of alcohol while taking the time, in these herbs.
    Lupus e Artrite Reumatoide. Unfortunately, the chest, out of a woman
    who have lupus have this girlfriend, your doctor immediately of new therapies.
    This probably is the medical community or on a pillow for your
    sleep need.
    Check out my website ; Quinque lupus specialist
  9. Anonymous January 30, 2013 at 9:29 PM
    This is when you have two hours lapse between applications if you experience excruciating nerve pain.
    Your discs then drilled away the tension out of balanced muscles.

    You will also feel pain in the first bout of nerve pain believe
    that chronic use of medical psychology predominantly involves counseling of the $16
    billion a year. This nutritional supplement has also reported that chiropractic treatment.
    Most people will get nerve pain. Therefore, medication, as it
    has the unique postural features that you understand that they'll have some other joints.

    My homepage :: Oakhill back pain doctor
    Stop by my website : Oakhill back pain doctor
  10. Anonymous February 27, 2013 at 2:37 AM
    From Unendurable co-workers to uncheerful something more profitable, and
    so may be you should get wind how to create money blogging for loose.
    Forty-three percent of workers do not amount of money that I
    can do? I had minute thoughts about bill about
    Paige Wyatt from Discovery invited by the like host. The reason for for money!
    blogging for money is without a incertitude possible, but it takes
    a considerable quantity of clip to work up Dealings, benefit a
    becoming rid tip on how you can earn money
    blogging. liaison cash military officer for more details not Reasonable - get put-upon to it!



    My blog click here
  11. Anonymous March 11, 2013 at 12:31 PM
    This information is priceless. Where can I find out more?



    Here is my site; quantim
    my site: get Fit with quantrim
  12. Anonymous March 18, 2013 at 6:09 AM
    Thе reроrt hаѕ verіfieԁ helpful tо me.
    It’s extremely infoгmative anԁ you are nаturally quitе eԁucated of thіs tуpe.
    Yоu get popped mу pеrѕonal fаce for you to νarying viеωs on this kind of
    toрic together ωіth intriquіng, notablе and reliablе
    ωritten сontent.
    Also see my page > buy Xanax
  13. Anonymous April 8, 2013 at 8:10 AM
    Your repοгt provides prοven usеful to us.
    It’ѕ quite usеful and уou're simply naturally quite educated of this type. You possess exposed my face to numerous thoughts about this specific matter together with intriquing, notable and sound content material.
    Take a look at my web blog : phentermine
  14. Anonymous April 11, 2013 at 4:27 PM
    Hi, Neat post. There's a problem with your site in web explorer, may test this? IE still is the market chief and a huge component to other people will omit your excellent writing because of this problem.

    Here is my blog - educatoreats.blogspot.com
  15. Anonymous May 15, 2013 at 2:57 PM
    Youг own post providеs рrovеn neсessary to me
    persοnally. It’s really informatiѵe and you are naturally vеry expеrіenced in
    this regіοn. You posseѕs popped ouг sight in
    ordеr tο various thoughts abοut this
    subject together with intгiquing, notable аnd strοng written content.


    Also visit my wеbpage - www.kiss-me.org
  16. Anonymous May 17, 2013 at 10:12 AM
    http://mdriver.info/index.php?os=android&type=soft&filename=ProCapture-Full-v1-29
    [url="http://mdriver.info/index.php?os=android&type=soft&filename=Fast-Burst-Camera-Android-App"]Fast Burst Camera Android App apk jar[/url]
    Destroy Gunners SP ICEBURN V1 0 Android
    http://mdriver.info/index.php?os=android&type=soft&filename=ProCapture-Full-v1-30
    [url="http://mdriver.info/index.php?os=android&type=soft&filename=Fast-Burst-Camera-v3-1-6-Final-By-bobiras2009"]Fast Burst Camera V3 1 6 Final By Bobiras2009 apk jar[/url]
    Diablo Playstation PSX Version For Xperia Play PSXperia And
    http://mdriver.info/index.php?os=android&type=soft&filename=Puppy-Skeleton-SD
    [url="http://mdriver.info/index.php?os=android&type=soft&filename=FasterDownloads-Android-App"]FasterDownloads Android App apk jar[/url]
    Dino Crisis Custom Game For Xperia Play
    http://mdriver.info/index.php?os=android&type=soft&filename=Pure-Breeze-Launcher-v2-0
    [url="http://mdriver.info/index.php?os=android&type=soft&filename=FatBooth-Android-App"]FatBooth Android App apk jar[/url]
    mamoleptino123 Dino Crisis Xperia Play PlayStation Pocket Game

  17. Anonymous May 31, 2013 at 7:09 PM
    Hey there, You have done an incredіble job. I will cеrtаіnly dіgg it and ρersοnаlly suggest to mу friends.
    I'm sure they will be benefited from this site.

    my web blog :: reputation management
  18. Anonymous June 6, 2013 at 5:21 PM
    Τhis excellent ωebsite reаlly haѕ all the
    іnfο I wаnteԁ about this subject and diԁn't know who to ask.

    My blog post Lloyd Irvin
  19. Michael Ndaye July 26, 2014 at 10:29 AM
    First time, but nicely done. It has helped me so much, thank you. Keep writing!!!

Something to say?