300-410 Question 225
Single answerAn enterprise network engineer has enabled Unicast Reverse Path Forwarding (uRPF) on a router to mitigate spoofed traffic attacks. The engineer is using uRPF in strict mode on an interface. After implementation, users report connectivity issues when accessing certain external resources. What could be causing this issue?
- A
The external resources have asymmetric routing paths, causing uRPF strict mode to drop legitimate return traffic.
- B
uRPF in strict mode requires additional CPU resources, leading to performance degradation and packet loss.
- C
The router's routing table does not have a default route, causing uRPF to fail for unknown destinations.
- D
uRPF strict mode blocks all traffic from unknown sources, including legitimate traffic with public IP addresses.
Show answer and explanation
Correct answer: A
Explanation
Unicast Reverse Path Forwarding (uRPF) in strict mode is a security feature that validates the source IP address of incoming packets by checking the router's routing table. It ensures that the incoming packet's source address is reachable via the same interface it was received on. In environments with asymmetric routing, where the return path for traffic differs from the forward path, uRPF strict mode may incorrectly drop legitimate packets because the validation fails. This highlights the importance of understanding the network's routing topology before implementing uRPF in strict mode.
- A. Correct.
Correct. uRPF strict mode verifies that the source IP address of incoming packets has a matching route in the routing table and that the interface receiving the packet matches the outgoing interface. In scenarios with asymmetric routing, legitimate traffic can be dropped because the return path does not match the expected interface.
- B. Incorrect.
Incorrect. While uRPF does require additional CPU resources, this is not the primary cause of the described connectivity issues in this scenario.
- C. Incorrect.
Incorrect. uRPF in strict mode relies on the routing table to validate source addresses, but the absence of a default route would not explain the asymmetric routing issue described.
- D. Incorrect.
Incorrect. uRPF does not indiscriminately block all traffic from unknown sources. Instead, it performs a specific verification based on the routing table and interface.