Every time someone wonders about the viability of unicast reverse path forwarding (uRPF) as source address validation technique at the edge of an ISP network, someone else inevitably claims it can’t possibly work due to asymmetrical routing issues. Is the situation really so black-and-white?

What Is uRPF?

uRPF is a very simple (and crude) source IP address validation mechanism. It uses IP routing table to verify whether the source IP address of an incoming packet makes sense:

• Strict uRPF requires a match between the input interface and the FIB next-hop interface for the source IP address;
• Loose uRPF requires the presence of a prefix matching source IP address in the FIB. Default route may or may not be considered a match.

What can uRPF check?

Strict uRPF is ideal when you want to check the traffic coming from a user with a single uplink. As the user has a single uplink, the only path to reach the user is through the provider edge (PE) router performing the uRPF check. If the source IP address of an incoming packet doesn’t match the reverse path, the user is obviously trying to spoof its source IP address.

Strict uRPF may drop legitimate packets of multihomed customers when the customer wants its upstream ISPs to prefer one of the uplinks, but sends the outbound packets over another uplink. It fares no better in any environment with asymmetrical routing (pretty common in the Internet core).

Loose uRPF will catch packets sent from dark address space, but won’t stop source IP address spoofing using legitimate globally-reachable IP addresses. It’s becoming quite useless in the IPv4 world (most of the available IPv4 space is advertised to the global Internet).

Is uRPF useful?

As always, the only correct answer is “it depends.” Strict uRPF is the ideal tool to use on PE routers that use static routing toward the customers (most residential and SMB customers). These customers are also least likely to have proper security and are thus most exposed to botnet exploits. Running uRPF on these links is mandatory (IMHO), but of course few ISPs do it (because it requires an extra configuration line?).

Strict uRPF is pretty useless on inter-ISP links, and loose uRPF is not much better in IPv4 world. Loose uRPF might still make sense in IPv6 world.

Any other scenarios/thoughts? Please share them in the comments.

More information

The following two RFCs are mandatory reading for anyone designing or running an ISP network:

• Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing (RFC 2827);
• Ingress Filtering for Multihomed Networks (RFC 3704).