350-401 Question 566
Single answerA network engineer is tasked with implementing unicast reverse path forwarding (uRPF) on a corporate router to mitigate spoofed IP packets from entering the network. The engineer configures uRPF in strict mode on an interface. However, during testing, legitimate traffic from a remote network is being dropped. What could be the most likely reason for this behavior?
- A
The remote network's return path does not match the source address in the router's routing table.
- B
The router's CPU is overloaded, causing uRPF to drop packets indiscriminately.
- C
uRPF strict mode does not support asymmetric routing, which is causing legitimate traffic to be dropped.
- D
The interface where uRPF is configured is not set as an ingress interface.
Show answer and explanation
Correct answer: A
Explanation
uRPF strict mode ensures that packets entering the router have a valid source IP address that matches an existing route in the routing table and that the route points to the same interface where the packet was received. In environments with asymmetric routing, the return path may not match the source, causing legitimate packets to be dropped. This is a common challenge with uRPF strict mode in complex networks.
- A. Correct.
Correct: uRPF strict mode requires that the source IP address of incoming packets has a matching route in the routing table with the same interface as the ingress interface. If the network has asymmetric routing, this condition may not be met, causing legitimate traffic to be dropped.
- B. Incorrect.
Incorrect: uRPF is a lightweight mechanism and does not rely heavily on CPU resources. Dropped packets are not due to CPU overload in this scenario.
- C. Incorrect.
Incorrect: While uRPF strict mode does not support asymmetric routing, this is already covered in the explanation for Option 1. This option is redundant and less specific.
- D. Incorrect.
Incorrect: uRPF is applied to ingress interfaces to validate traffic coming into the router. If uRPF was not applied to an ingress interface, the problem described in the question would not occur.