ip verify unicast source reachable-via effective on border routers?
ip verify unicast source reachable-via uses the router's routing table to detect and prevent spoofing. On a border router with very few routes, and a static default route to the ISP's router, would verify unicast source reachable-via be effective? It seems like it would only stop a spoofed packet with the source and destination of the WAN interface, or the with an address matching the subnet between the border router and the firewall. All other packets would be allowed based on the 0.0.0.0 0.0.0.0 x.x.x.x (x being the ISP's router) default route, wouldn't they?
Perhaps this questions should be in the Security/General forum? Would a moderator be able to move it there for me? I prefer not to double-post.
Re: ip verify unicast source reachable-via effective on border r
It seems that I'm misunderstanding something about how ip verify unicast sourc reachable-via, or by its old name, ip verify unicast reverse-path works. It's designed for use on border routers, so the default route problem doesn't make sense. Does anyone know of any Cisco white papers or references on Cisco's site that explain it clearly?
We are pleased to announce availability of Beta software for 16.6.3. 16.6.3 will be the second rebuild on the 16.6 release train targeted towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are looking for early feedback from custome...