<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">For strict-mode... Completely agree.<div class=""><br class=""></div><div class="">As has been previously said, this is a tool that all players involved need to understand. This is no different than everyone correctly using BGP in their application for their outcomes.<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Sep 29, 2021, at 12:07 PM, Adam Thompson <<a href="mailto:athompson@merlin.mb.ca" class="">athompson@merlin.mb.ca</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;" class="">We just ran into a typical case where uRPF caused a partial outage for one of my customers: the customer is multi-homed, with another provider that I'm<span class="Apple-converted-space"> </span><b class="">also</b> connected to. Customer advertised a longer-prefix to the other guy, so I started sending traffic destined for Customer to the Other Provider... who then promptly dropped it because they had uRPF enabled on the peering link, and they were seeing random source IPs that weren't mine. Well... yeah, that can happen (semi-legitimately) anytime you have a topological triangle in peering.</div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;" class="">I've concluded over the last 2 years that uRPF is<span class="Apple-converted-space"> </span><b class="">only</b> useful on interfaces pointing directly at non-multi-homed customers, and<span class="Apple-converted-space"> </span><b class="">actively dangerous<span class="Apple-converted-space"> </span></b>anywhere else.</div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;" class="">-Adam<br class=""></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><div id="Signature" class=""><div class=""><div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;" class=""><b style="text-align: start; background-color: rgb(255, 255, 255);" class=""><span style="margin: 0px; font-size: 10pt; color: rgb(68, 84, 106);" class="">Adam Thompson</span></b><span style="margin: 0px; font-size: 9pt; color: rgb(68, 84, 106); text-align: start; background-color: rgb(255, 255, 255);" class=""><br class="">Consultant, Infrastructure Services<br class=""><img class="EmojiInsert" alt="1593169877849" data-outlook-trace="F:2|T:2" src="cid:bbb702c0-5f25-4b78-8e3c-77d76b316dc7" style="margin: 0px; max-width: 100%; height: auto;"><br class="">100 - 135 Innovation Drive<br class="">Winnipeg, MB, R3T 6A8<br class="">(204) 977-6824 or 1-800-430-6404 (MB only)<br class=""><a href="mailto:athompson@merlin.mb.ca" target="_blank" rel="noopener noreferrer" style="margin: 0px;" class=""><span style="margin: 0px;" class="">athompson@merlin.mb.ca</span></a><br class=""><a href="http://www.merlin.mb.ca/" target="_blank" rel="noopener noreferrer" style="margin: 0px;" class=""><span style="margin: 0px;" class="">www.merlin.mb.ca</span></a></span><br class=""></div></div></div></div><div id="appendonsend" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div><hr tabindex="-1" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; display: inline-block; width: 632.09375px;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class=""></span><div id="divRplyFwdMsg" dir="ltr" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><font face="Calibri, sans-serif" style="font-size: 11pt;" class=""><b class="">From:</b><span class="Apple-converted-space"> </span>NANOG <<a href="mailto:nanog-bounces+athompson=merlin.mb.ca@nanog.org" class="">nanog-bounces+athompson=merlin.mb.ca@nanog.org</a>> on behalf of Amir Herzberg <<a href="mailto:amir.lists@gmail.com" class="">amir.lists@gmail.com</a>><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>September 28, 2021 20:06<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Randy Bush <<a href="mailto:randy@psg.com" class="">randy@psg.com</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>North American Network Operators' Group <<a href="mailto:nanog@nanog.org" class="">nanog@nanog.org</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: uPRF strict more</font><div class=""> </div></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><div dir="ltr" class="">Randy, great question. I'm teaching that it's very rarely, if ever, used (due to high potential for benign loss); it's always great to be either confirmed or corrected... <div class=""><br class=""></div><div class="">So if anyone replies just to Randy - pls cc me too (or, Randy, if you could sum up and send to list or me - thanks!)</div><div class=""><br class=""></div><div class="">Amir<br clear="all" class=""><div class=""><div dir="ltr" class="x_gmail_signature"><div dir="ltr" class=""><div dir="ltr" class="">--<span class="Apple-converted-space"> </span><br class=""><div class="">Amir Herzberg<br class=""></div><div class=""><br class=""></div><div class="">Comcast professor of Security Innovations, Computer Science and Engineering, University of Connecticut</div><div class="">Homepage: <a href="https://sites.google.com/site/amirherzberg/home" target="_blank" class="">https://sites.google.com/site/amirherzberg/home</a></div><div class="">`Applied Introduction to Cryptography' textbook and lectures:<a href="https://sites.google.com/site/amirherzberg/applied-crypto-textbook" target="_blank" class=""> https://sites.google.com/site/amirherzberg/applied-crypto-textbook</a></div><div class=""><br class=""></div><br class=""></div></div></div></div><br class=""></div></div><br class=""><div class="x_gmail_quote"><div dir="ltr" class="x_gmail_attr">On Tue, Sep 28, 2021 at 8:50 PM Randy Bush <<a href="mailto:randy@psg.com" class="">randy@psg.com</a>> wrote:<br class=""></div><blockquote class="x_gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;">do folk use uPRF strict mode? i always worried about the multi-homed<br class="">customer sending packets out the other way which loop back to me; see<br class="">RFC 8704 §2.2<br class=""><br class="">do vendors implement the complexity of 8704; and, if so, do operators<br class="">use it?<br class=""><br class="">clue bat please<br class=""><br class="">randy</blockquote></div></div></div></blockquote></div><br class=""></div></body></html>