ip verify unicast source reachable-via uses the router's routing table to detect and prevent spoofing. On a border router with very few routes, and a static default route to the ISP's router, would verify unicast source reachable-via be effective? It seems like it would only stop a spoofed packet with the source and destination of the WAN interface, or the with an address matching the subnet between the border router and the firewall. All other packets would be allowed based on the 0.0.0.0 0.0.0.0 x.x.x.x (x being the ISP's router) default route, wouldn't they?

Perhaps this questions should be in the Security/General forum? Would a moderator be able to move it there for me? I prefer not to double-post.

Thanks!