Specifications

IP Switching Commands
ipv6 verify unicast reverse-path
ISW-82
Cisco IOS IP Switching Command Reference
May 2008
The Unicast RPF feature performs a reverse lookup in the CEF table to check if any packet received at
a router interface has arrived on a path identified as a best return path to the source of the packet. If a
reverse path for the packet is not found, Unicast RPF can drop or forward the packet, depending on
whether an ACL is specified in the Unicast RPF command. If an ACL is specified in the command, then
when (and only when) a packet fails the Unicast RPF check, the ACL is checked to determine whether
the packet should be dropped (using a deny statement in the ACL) or forwarded (using a permit statement
in the ACL). Whether a packet is dropped or forwarded, the packet is counted in the global IP traffic
statistics for Unicast RPF drops and in the interface statistics for Unicast RPF.
If no ACL is specified in the Unicast RPF command, the router drops the forged or malformed packet
immediately and no ACL logging occurs. The router and interface Unicast RPF counters are updated.
Unicast RPF events can be logged by specifying the logging option for the ACL entries used by the
Unicast RPF command. Log information can be used to gather information about the attack, such as
source address, time, and so on.
Note When you configure Unicast RPF for IPv6 on the Cisco 12000 series Internet router, the most recently
configured checking mode is not automatically applied to all interfaces as on other platforms. You must
enable Unicast RPF for IPv6 separately on each interface.
When you configure a SPA on the Cisco 12000 series Internet router, the interface address is in the
format slot/subslot/port.
The optional access-list keyword for the ipv6 verify unicast reverse-path command is not supported
on the Cisco 12000 series Internet router. For information about how Unicast RPF can be used with
ACLs on other platforms to mitigate the transmission of invalid IPv4 addresses (perform egress filtering)
and to prevent (deny) the reception of invalid IPv4 addresses (perform ingress filtering), refer to the
“Configuring Unicast Reverse Path Forwarding” chapter in the “Other Security Features” section of the
Cisco IOS Security Configuration Guide, Release 12.4.
Note When using Unicast RPF, all equal-cost “best” return paths are considered valid. This means that Unicast
RPF works in cases where multiple return paths exist, provided that each path is equal to the others in
terms of the routing cost (number of hops, weights, and so on).
Do not use Unicast RPF on core-facing interfaces that are internal to the network. Internal interfaces are
likely to have routing asymmetry, meaning that there are multiple routes to the source of a packet. Apply
Unicast RPF only where there is natural or configured symmetry.
For example, routers at the edge of the network of an Internet service provider (ISP) are more likely to
have symmetrical reverse paths than routers that are in the core of the ISP network. Routers that are in
the core of the ISP network have no guarantee that the best forwarding path out of the router will be the
path selected for packets returning to the router. Hence, it is not recommended that you apply Unicast
RPF where there is a chance of asymmetric routing. It is simplest to place Unicast RPF only at the edge
of a network or, for an ISP, at the customer edge of the network.
Examples Unicast Reverse Path Forwarding on a Serial Interface
The following example shows how to enable the Unicast RPF feature on a serial interface:
interface serial 5/0/0
ipv6 verify unicast reverse-path