Hello, is there some guide that covers the "this will go to the RP on Sup..." and the "this will also affect ..." and "this is limited to xy interfaces/vlans/routes" stuff ?
We thought about implementing strict mode on some customer interfaces (those special customers who always get attacked and sometimes take revenge ;)) some time ago, but then saw that doc here: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/secure.html We stopped after reading those sentences (it even does not mantion any IPv6 limitations): "The most recently configured mode is automatically applied to all ports configured for unicast RPF check." "When you enter the ip verify unicast source reachable-via command, the unicast RPF check mode changes on all ports in the switch." If that is not just a bad/wrong explanation or a joke, what sense makes urpf if it cannot be enabled and configured for each interface individually and as a consequence of this cannot be implemented without possible service impact ? I am sure we are not the only ones that do not actvate it because it may cause more problems than it will solve. btw, if there is a way to enable it for single (vlan)interfaces (up to a few hundred) without any effect for other interfaces, please let me know. kind regards Rolf > Hi, > > On Sat, Mar 16, 2013 at 03:59:25PM -0700, Laurent Geyer wrote: >> Curious, how does uRPF help under this scenario? Although the source >> address is spoofed, the target is stil valid destination address. > > uRPF helps everybody else - those of your customers with infected machines > (and don't claim there aren't any) will not be able to initiate reflection > attacks against other folks. > > gert, > deploying uRPF since 10+ years "it's really not that hard" > > (PS: and yes, the fact that Sup720 can't do IPv6 uRPF in hardware stinks) > -- > USENET is *not* the non-clickable part of WWW! > //www.muc.de/~gert/ > Gert Doering - Munich, Germany > [email protected] > fax: +49-89-35655025 > [email protected] > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
