Understanding uRPF Loose Mode /Strict Mode,

jskfan
jskfan used Ask the Experts™
on
Understanding uRPF Loose Mode /Strict Mode,

Let's say we have R1 connected on both of its 2 interfaces to R2 and R3
R1 interface IP address(192.168.12.1/24) connecting to R2
R1 interface IP address(192.168.13.1/24) connecting to R3

R2 interface IP address(192.168.12.2/24) connecting to R1
R3 interface IP address(192.168.13.3/24) connecting to R1

R2 has a loopback 0 with ip address 2.2.2.2/32

R1 has static route : Ip route 2.2.2.2 255.255.255.255 192.168.12.2

For test purpose I have created lopback 0 on R3 with the same IP address 2.2.2.2/32 as the loopback 0 on R2

With Strict Mode or Loose Mode configured, I can ping from R2 (source Loopback 0:2.2.2.2) to R1 (192.168.12.1)
I can see the ping replies. but I cannot ping from R3 (Source Loopback 0: 2.2.2.2) to R1 (192.16.13.1).
However when reading online, it states that with Loose Mode, R1 will accept packets from R3 and with Strict Mode it does not.
from my side, I still cannot see the difference between Strict/Loose Mode as both will cause Ping fails from R3 source loopback 0 to R1

Any clarification on this ?

Thank you
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018
Commented:
Difference is:
Strict mode - ingress packet IP source address must come from exact ingress interface where the most specific route to destination of IP source packet is found in FIB
ip cef
interface FastEthernet 0/0
ip verify unicast source reachable-via rx

Open in new window

Loose mode - ingress packet IP source address may come from other ingress interface (not from direction where the most specific route to direction of IP source packet is located in FIB), but route to IP packet source address still need to be present in FIB
ip cef
interface FastEthernet 0/0
ip verify unicast source reachable-via any

Open in new window

Since it is related to FIB and not to RIB, IP CEF must be enabled.

You can try to use public IP address space instead of private for this lab, since there are some limitations regarding private IP address space:
Loose mode allows Unicast RPF to automatically detect and drop packets such as the following:


    IETF RFC 1918 source addresses
    Other Documenting Special Use Addresses (DUSA) that should not appear in the source
    Unallocated addresses that have not been allocated by the Regional Internet Registries (RIRs)
    Source addresses that are routed to a null interface on the router

Author

Commented:
Ping Reply still times out, when Ping Request comes from a different Source Interface than the one when send the static route to.
and this is either for Strict or Loose mode..

So this makes me unable to see the difference between both modes.

Author

Commented:
I will revisit this topic later

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial