300-410 Question 227
Single answerA network administrator has configured Unicast Reverse Path Forwarding (uRPF) on a router using the 'strict mode' to prevent IP spoofing in the network. However, users behind a multi-homed branch office router with asymmetric routing are experiencing connectivity issues. What is the best approach to resolve this issue while maintaining uRPF functionality?
- A
Switch to uRPF 'loose mode' on the affected interface.
- B
Disable uRPF entirely on the affected interface.
- C
Increase the logging level for uRPF violations to troubleshoot.
- D
Use the 'allow-default' option with uRPF strict mode to resolve the asymmetric routing issue.
Show answer and explanation
Correct answer: A
Explanation
uRPF strict mode enforces that a packet must arrive on the same interface that is used to reach the source IP in the routing table. In environments with asymmetric routing, such as multi-homed branch offices, strict mode can block legitimate traffic. Switching to uRPF loose mode provides a compromise by validating the existence of a route to the source IP in the routing table without enforcing interface matching, ensuring both connectivity and basic security.
- A. Correct.
Switching to uRPF 'loose mode' allows the router to validate packets based on the existence of a route to the source IP in the routing table, rather than requiring that the incoming interface matches the route. This resolves issues caused by asymmetric routing while still providing a level of security.
- B. Incorrect.
Disabling uRPF entirely would remove protection against IP spoofing, which is not recommended in most environments.
- C. Incorrect.
Increasing the logging level for uRPF violations helps with troubleshooting but does not resolve the asymmetric routing issue.
- D. Incorrect.
The 'allow-default' option in strict mode allows responses for packets sourced from default routes, but it does not address the asymmetric routing scenario as effectively as switching to loose mode.