350-401 Question 562
Single answerA network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco router to prevent IP spoofing attacks. The network has asymmetric routing paths, and some legitimate traffic is being dropped after enabling uRPF. Which uRPF mode should the engineer configure to address this issue while still maintaining anti-spoofing protection?
- A
Strict mode
- B
Loose mode
- C
VRF mode
- D
Feasible Path mode
Show answer and explanation
Correct answer: D
Explanation
In networks with asymmetric routing, strict mode may drop legitimate traffic because it enforces that packets arrive on a specific interface. Feasible Path mode is the best choice in such scenarios because it allows packets to pass as long as there is a valid route to the source IP address, regardless of the interface. This ensures anti-spoofing protection while accommodating the nature of asymmetric routing.
- A. Incorrect.
Strict mode requires that the source IP address of the packet must be reachable via the same interface it was received on. This is highly restrictive and not recommended in networks with asymmetric routing, as it can drop legitimate traffic.
- B. Incorrect.
Loose mode only checks whether the source IP address of the packet exists in the routing table, regardless of the interface. While it is less restrictive, it may not provide sufficient anti-spoofing protection in certain scenarios.
- C. Incorrect.
VRF mode is used in environments with Virtual Routing and Forwarding instances to enforce uRPF checks per VRF. However, this does not specifically address the challenges posed by asymmetric routing.
- D. Correct.
Feasible Path mode allows the router to accept packets if a feasible path exists to the source IP address in the routing table, even if the packet did not arrive on the best route interface. This mode is ideal for asymmetric routing environments as it provides a balance between security and flexibility.