Solved: ip verify unicast reverse-path

cisco_lite · ‎01-07-2009

On a router and ASA firewall, should RPF be enabled on all the given interfaces.

Jon Marshall · ‎01-07-2009

You should generally apply it at the exit point to your network because within your network you may well have asymmetrical paths. Have a look at this doc which goes into where Unicast RPF should be used -

http://www.cisco.com/en/US/docs/ios/11_1/feature/guide/uni_rpf.html#wp1042716

Jon

View solution in original post

mikegrous · ‎01-07-2009

This is my understanding as well.

View solution in original post

mikegrous · ‎01-07-2009

typically youd only apply it on your WAN interface as you should be trusting your LAN routes

Jon Marshall · ‎01-07-2009

You should generally apply it at the exit point to your network because within your network you may well have asymmetrical paths. Have a look at this doc which goes into where Unicast RPF should be used -

http://www.cisco.com/en/US/docs/ios/11_1/feature/guide/uni_rpf.html#wp1042716

Jon

cisco_lite · ‎01-07-2009

What is difference between

ip verify unicast reverse-path

and

ip verify unicast source reachable-via any

What is the default Unicast RPF mode; loose or strict.

Regards.

mikegrous · ‎01-07-2009

In reguard to the first question:

R8(config-if)#ip verify unicast ?

reverse-path Reverse path validation of source address (old command format)

source Validation of source address

cisco_lite · ‎01-07-2009

From this I understand that both of the above commands have the same effect, where in reverse-path is an old command.

Please confirm.

mikegrous · ‎01-07-2009

This is my understanding as well.