Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

ip verify unicast source reachable-via effective on border routers?

ip verify unicast source reachable-via uses the router's routing table to detect and prevent spoofing. On a border router with very few routes, and a static default route to the ISP's router, would verify unicast source reachable-via be effective? It seems like it would only stop a spoofed packet with the source and destination of the WAN interface, or the with an address matching the subnet between the border router and the firewall. All other packets would be allowed based on the 0.0.0.0 0.0.0.0 x.x.x.x (x being the ISP's router) default route, wouldn't they?

Perhaps this questions should be in the Security/General forum? Would a moderator be able to move it there for me? I prefer not to double-post.

Thanks!

1 ACCEPTED SOLUTION

Accepted Solutions
Super Bronze
3 REPLIES
New Member

Re: ip verify unicast source reachable-via effective on border r

It seems that I'm misunderstanding something about how ip verify unicast sourc reachable-via, or by its old name, ip verify unicast reverse-path works. It's designed for use on border routers, so the default route problem doesn't make sense. Does anyone know of any Cisco white papers or references on Cisco's site that explain it clearly?

Super Bronze
New Member

Re: ip verify unicast source reachable-via effective on border r

Those links are very helpful, thanks Joseph.

1851
Views
0
Helpful
3
Replies
CreatePlease to create content