350-401 Question 564
Single answerA network administrator has implemented Unicast Reverse Path Forwarding (uRPF) on a border router to prevent spoofed IP packets from entering the network. However, legitimate traffic from a multihomed customer with asymmetric routing is being dropped. Which uRPF mode should the administrator configure to resolve this issue while still maintaining protection against spoofed traffic?
- A
Strict mode
- B
Loose mode
- C
VRF mode
- D
Feasible mode
Show answer and explanation
Correct answer: B
Explanation
In environments with asymmetric routing, strict uRPF can cause legitimate traffic to be dropped because the source IP address and interface may not match the routing table's expectations. Loose mode is more appropriate in such cases as it only requires the existence of a route to the source IP, avoiding interface checks. This balances security and functionality, ensuring legitimate traffic flows while still mitigating spoofed packets.
- A. Incorrect.
Strict mode requires that the source IP address of an incoming packet matches the routing table entry for the interface it was received on. This mode is overly restrictive for asymmetric routing scenarios and may drop legitimate traffic.
- B. Correct.
Loose mode only checks that a route to the source IP address exists in the routing table, regardless of the interface. This mode is suitable for asymmetric routing scenarios since it does not require the interface match, thus preventing legitimate traffic drops.
- C. Incorrect.
VRF mode is used for implementing uRPF in Virtual Routing and Forwarding (VRF) environments. It is not relevant to solving the issue of asymmetric routing in this scenario.
- D. Incorrect.
Feasible mode is not a valid uRPF mode. The available modes for uRPF are strict, loose, and VRF.