unicast source reachable-via rx

Not sure if this is the correct place for this but it seems security releated to me.

Does this command have any use if i have the ios firewall configured? And if so where should you apply it, the inside (LAN interface) or the outside (Internet interface)?

thanks

Find more posts tagged with

Comments

johnwest43

Anyone ?

1000 cool points to the first response:D

networker050184

What are you trying to accomplish? uRPF isn't directly related to the IOS firewall feature, if that is what you are asking.

johnwest43

I know its not related to the firewall feature, i am just curious thats all. seems you can accomplish the same thing with an access list.

networker050184

You could basically do the same thing with ACLs, but they must be updated manually. uRPF uses the routing table so it will always have the latest information on the reverse path for traffic.

jason_lunde

johnwest43 wrote: »

Not sure if this is the correct place for this but it seems security releated to me.

Does this command have any use if i have the ios firewall configured? And if so where should you apply it, the inside (LAN interface) or the outside (Internet interface)?

thanks

"they", though I dont know quite who they are, say to do it on your outside interfaces.

networker050184

jason_lunde wrote: »

"they", though I dont know quite who they are, say to do it on your outside interfaces.

Definitely better on the outside interface in this set up. The way that uRPF works is its going to look up the destination interface for the source address. You are going to have your internal networks known and you can just use the allow default option to cover all internet routes unless you are receiving a full table. If you start multihoming and have asymetric routing than it can become an issue.

Ahriakin

Also uRPF gets loaded into CEF, depending on the platform and if/how it handles distribution to hardware accelerating line cards it can be more efficient than the same rules via an ACL. Mostly though as mentioned it's more convenient at your edge since it's essentially self updating as long as your routing table is accurate.