Cisco uRPF failures
saku+nanog at ytti.fi
Sat Sep 13 15:00:31 CDT 2008
On (2008-09-13 13:26 -0500), Brandon Ewing wrote:
> Are you sure? According to the IOS guide for 3560E/3750E, "ip verify" is
> still an unsupported interface command. I don't have a 3560E handy to test
> on, but I know that a non-E 3560 refuses it with a notice regarding how
> verification is not supported by hardware.
To be honest I'm not sure. Feature-wise highlights what I've taken note of
E series in 3560 is jumbo MTU support in L3 and uRPF in comparison to non E,
apart from the obvious 10GE and PSU enhancements.
While I haven't personally ran 3560E, I'm fairly confident that it's
supported, in hardware (And software to turn it on).
uRPF is mentioned here:
• Unicast RPF feature helps mitigate problems caused by the introduction of
malformed or forged (spoofed) IP source addresses into a network by
discarding IP packets that lack a verifiable IP source address.
More information about the NANOG