<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Disclosure I work for Cisco and try to look after some of their peering guidelines.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Agree with Adam’s statement, use uRPF on edge DIA customers. Using it elsewhere on the network eventually is going to cause some issue and its usefulness today is almost nil. That being said we still see large providers who have it turned
on for peering/transit interfaces either out of legacy configuration or other reasons. The vast majority do not use it for those interface roles.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Phil<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">NANOG <nanog-bounces+bedard.phil=gmail.com@nanog.org> on behalf of Adam Thompson <athompson@merlin.mb.ca><br>
<b>Date: </b>Wednesday, September 29, 2021 at 1:08 PM<br>
<b>To: </b>Amir Herzberg <amir.lists@gmail.com>, Randy Bush <randy@psg.com><br>
<b>Cc: </b>North American Network Operators' Group <nanog@nanog.org><br>
<b>Subject: </b>Re: uPRF strict more<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">We just ran into a typical case where uRPF caused a partial outage for one of my customers: the customer is multi-homed, with another provider that I'm
<b>also</b> connected to. Customer advertised a longer-prefix to the other guy, so I started sending traffic destined for Customer to the Other Provider... who then promptly dropped it because they had uRPF enabled on the peering link, and they were seeing
random source IPs that weren't mine. Well... yeah, that can happen (semi-legitimately) anytime you have a topological triangle in peering.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">I've concluded over the last 2 years that uRPF is
<b>only</b> useful on interfaces pointing directly at non-multi-homed customers, and
<b>actively dangerous </b>anywhere else.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">-Adam<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#44546A;background:white">Adam Thompson</span></b><span style="font-size:9.0pt;color:#44546A;background:white"><br>
Consultant, Infrastructure Services<br>
<img width="32" height="32" style="width:.3333in;height:.3333in" id="_x0000_i1026" src="cid:bbb702c0-5f25-4b78-8e3c-77d76b316dc7" alt="1593169877849"><br>
100 - 135 Innovation Drive<br>
Winnipeg, MB, R3T 6A8<br>
(204) 977-6824 or 1-800-430-6404 (MB only)<br>
<a href="mailto:athompson@merlin.mb.ca" target="_blank">athompson@merlin.mb.ca</a><br>
<a href="http://www.merlin.mb.ca/" target="_blank">www.merlin.mb.ca</a></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="0" width="100%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> NANOG <nanog-bounces+athompson=merlin.mb.ca@nanog.org> on behalf of Amir Herzberg <amir.lists@gmail.com><br>
<b>Sent:</b> September 28, 2021 20:06<br>
<b>To:</b> Randy Bush <randy@psg.com><br>
<b>Cc:</b> North American Network Operators' Group <nanog@nanog.org><br>
<b>Subject:</b> Re: uPRF strict more</span> <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">Randy, great question. I'm teaching that it's very rarely, if ever, used (due to high potential for benign loss); it's always great to be either confirmed or corrected...
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So if anyone replies just to Randy - pls cc me too (or, Randy, if you could sum up and send to list or me - thanks!)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Amir<br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<p class="MsoNormal">Amir Herzberg<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Comcast professor of Security Innovations, Computer Science and Engineering, University of Connecticut<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Homepage: <a href="https://sites.google.com/site/amirherzberg/home" target="_blank">https://sites.google.com/site/amirherzberg/home</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">`Applied Introduction to Cryptography' textbook and lectures:<a href="https://sites.google.com/site/amirherzberg/applied-crypto-textbook" target="_blank"> https://sites.google.com/site/amirherzberg/applied-crypto-textbook</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Sep 28, 2021 at 8:50 PM Randy Bush <<a href="mailto:randy@psg.com">randy@psg.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">do folk use uPRF strict mode? i always worried about the multi-homed<br>
customer sending packets out the other way which loop back to me; see<br>
RFC 8704 §2.2<br>
<br>
do vendors implement the complexity of 8704; and, if so, do operators<br>
use it?<br>
<br>
clue bat please<br>
<br>
randy<o:p></o:p></p>
</blockquote>
</div>
</div>
</div>
</body>
</html>