Understanding uRPF Loose Mode /Strict Mode,

Understanding uRPF Loose Mode /Strict Mode,

Let's say we have R1 connected on both of its 2 interfaces to R2 and R3
R1 interface IP address(192.168.12.1/24) connecting to R2
R1 interface IP address(192.168.13.1/24) connecting to R3

R2 interface IP address(192.168.12.2/24) connecting to R1
R3 interface IP address(192.168.13.3/24) connecting to R1

R2 has a loopback 0 with ip address 2.2.2.2/32

R1 has static route : Ip route 2.2.2.2 255.255.255.255 192.168.12.2

For test purpose I have created lopback 0 on R3 with the same IP address 2.2.2.2/32 as the loopback 0 on R2

With Strict Mode or Loose Mode configured, I can ping from R2 (source Loopback 0:2.2.2.2) to R1 (192.168.12.1)
I can see the ping replies. but I cannot ping from R3 (Source Loopback 0: 2.2.2.2) to R1 (192.16.13.1).
However when reading online, it states that with Loose Mode, R1 will accept packets from R3 and with Strict Mode it does not.
from my side, I still cannot see the difference between Strict/Loose Mode as both will cause Ping fails from R3 source loopback 0 to R1

Any clarification on this ?

Thank you
jskfanAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JustInCaseCommented:
Difference is:
Strict mode - ingress packet IP source address must come from exact ingress interface where the most specific route to destination of IP source packet is found in FIB
ip cef
interface FastEthernet 0/0
ip verify unicast source reachable-via rx

Open in new window

Loose mode - ingress packet IP source address may come from other ingress interface (not from direction where the most specific route to direction of IP source packet is located in FIB), but route to IP packet source address still need to be present in FIB
ip cef
interface FastEthernet 0/0
ip verify unicast source reachable-via any

Open in new window

Since it is related to FIB and not to RIB, IP CEF must be enabled.

You can try to use public IP address space instead of private for this lab, since there are some limitations regarding private IP address space:
Loose mode allows Unicast RPF to automatically detect and drop packets such as the following:


    IETF RFC 1918 source addresses
    Other Documenting Special Use Addresses (DUSA) that should not appear in the source
    Unallocated addresses that have not been allocated by the Regional Internet Registries (RIRs)
    Source addresses that are routed to a null interface on the router
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jskfanAuthor Commented:
Ping Reply still times out, when Ping Request comes from a different Source Interface than the one when send the static route to.
and this is either for Strict or Loose mode..

So this makes me unable to see the difference between both modes.
0
jskfanAuthor Commented:
I will revisit this topic later
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.