R3303-HP HSR6800 Routers Security Configuration Guide

Network application

Figure 148 Network diagram

• Configure strict URPF check between an ISP network and a customer network, and loose URPF

check between ISPs.

• Configure ACLs for special packets or users.

Configuring URPF on an interface

URPF checks only packets arriving at an enabled interface.

Do not configure the allow-default-route keyword for loose URPF check. Otherwise, URPF might fail to

work.

After configuring the URPF check on an interface, you can use the display ip interface command to view

statistics about packets discarded by URPF (displayed as "Drops" and "Suppressed drops").

To enable URPF on an interface:

Ste

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enter interface view.

interface interface-type

interface-number

N/A

3. Enable URPF check on the

interface.

ip urpf { loose | strict }

[ allow-default-route ] [ acl

acl-number ]

Disabled by default.