Users Guide

1472 Unicast Reverse Path Forwarding
uRPF validation may be enabled for VLAN routing interfaces and 6to4
tunnels. uRPF validation operates on both IPv4 and IPv6 packets. For ECMP
routes, only loose mode validation is performed.
Strict uRPF validation is useful only in networks with symmetric paths where
IP datagrams to the destination and from the destination traverse the same
routing interfaces. If the network has asymmetric paths then strict uRPF
validation will always fail. In networks with asymmetric paths, the
administrator can use the uRPF validation to verify that the IP datagram
sender is on a valid subnet.
Strict uRPF validation should not be used on internal interfaces as these are
likely to have routing asymmetry.
Ingress ACLs and uRPF validation can operate simultaneously. The uRPF
validation failures have a higher priority than any ACL permit rule.
For example, when there is a rule in the ACL to permit a packet based on
certain criteria, but the source IP address is not found in the routing table, a
uRPF validation failure will drop the packet even when the ACL rule results
in a match.
Limitations
uRPF validation requires that the routing table be used for both source and
destination IP addresses. Enabling uRPF effectively reduces the routing table
capacity by one half. The existing route failure mechanism will display and
log any routes that are in the RTO but fail to be added to the hardware route
table.
Enabling or disabling uRPF at the global configuration level causes the switch
to disable and re-enable routing.
uRPF dropped packet counters are supported per physical interface. The
counter indicates the sum of IPv4 and IPv6 uRPF dropped packets. There is
no hardware support for per-VLAN or global uRPF drop counters.