IPv4 uRPF commands -- display ip urpf

Use display ip urpf to display uRPF configuration.

Syntax

Centralized devices:

display ip urpf [ interface interface-type interface-number ]

Distributed devices in standalone mode:Centralized IRF devices:

display ip urpf [ interface interface-type interface-number ] [ slot slot-number [ cpu cpu-number ] ]

Distributed devices in IRF mode:

display ip urpf [ interface interface-type interface-number ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

interface interface-type interface-number: Specifies an interface by its type and number.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays uRPF configuration for all cards. (Distributed devices in standalone mode.)

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays uRPF configuration for all member devices. (Centralized IRF devices.) (IRF 3 incapable.)

slot slot-number: Specifies an IRF member device by its member ID or specifies a PEX by its virtual slot number. On an IRF fabric, this command displays uRPF configuration for all member devices if you do not specify a member device. On an IRF 3 system, this command displays uRPF configuration for all IRF member devices and PEXs if you do not specify an IRF member device or PEX. (Centralized IRF devices.) (IRF 3 capable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays uRPF configuration for all cards. (Distributed devices in IRF mode.) (IRF 3 incapable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device or specifies a PEX. The chassis-number argument represents the member ID of the IRF member device or the virtual chassis number of the PEX. The slot-number argument represents the slot number of the card or PEX. On an IRF fabric, this command displays uRPF configuration for all cards if you do not specify a card. On an IRF 3 system, this command displays uRPF configuration for all cards and PEXs if you do not specify a card or PEX. (Distributed devices in IRF mode.) (IRF 3 capable.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot.

Examples

# (Centralized devices.) Display uRPF configuration on the specified interface. (Applicable to routers.)

<Sysname> display ip urpf interface gigabitethernet 1/0/1

uRPF configuration information of interface GigabitEthernet1/0/1(failed):

Check type: strict

Allow default route

Link check

Suppress drop ACL: 3000

# (Centralized devices.) Display uRPF configuration on the specified interface. (Applicable to switches.)

<Sysname> display ip urpf interface vlan-interface 10

uRPF configuration information of interface Vlan-interface10(failed):

Check type: strict

Allow default route

Link check

Suppress drop ACL: 3000

# (Centralized devices.) Display uRPF configuration.

<Sysname> display ip urpf

Global uRPF configuration information(failed):

Check type: strict

Allow default route

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Display uRPF configuration for the specified slot.

<Sysname> display ip urpf slot 1

Global uRPF configuration information(failed):

Check type: strict

Allow default route

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Display uRPF configuration on the specified interface. (Applicable to routers.)

<Sysname> display ip urpf interface gigabitethernet 1/0/1 slot 1

uRPF configuration information of interface GigabitEthernet1/0/1(failed):

Check type: loose

Allow default route

Suppress drop ACL: 2000

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Display uRPF configuration on the specified interface. (Applicable to switches.)

<Sysname> display ip urpf interface vlan-interface 10 slot 1

uRPF configuration information of interface Vlan-interface10(failed):

Check type: loose

Allow default route

Suppress drop ACL: 2000

Table 1 Command output

Field | Description
(failed) | The system failed to deliver the uRPF configuration to the forwarding chip because of insufficient chip resources. This field is not displayed if the delivery is successful.
Check type | uRPF check mode: loose or strict.
Allow default route | Using the default route is allowed.
Link check | Link layer check is enabled.
Suppress drop ACL | ACL used for drop suppression.

IPv4 uRPF commands -- display ip urpf security-zone

Use display ip urpf security-zone to display uRPF configuration.

Syntax

Centralized devices:

display ip urpf security-zone zone-name

Distributed devices in standalone mode:Centralized IRF devices:

display ip urpf security-zone zone-name [ slot slot-number [ cpu cpu-number ] ]

Distributed devices in IRF mode:

display ip urpf security-zone zone-name [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

zone-name: Specifies a security zone by its name, a case-insensitive string of 1 to 31 characters. The string cannot include hyphens (-).

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays uRPF configuration for all cards. (Distributed devices in standalone mode.)

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays uRPF configuration for all member devices. (Centralized IRF devices.) (IRF 3 incapable.)

slot slot-number: Specifies an IRF member device by its member ID or specifies a PEX by its virtual slot number. On an IRF fabric, this command displays uRPF configuration for all member devices if you do not specify a member device. On an IRF 3 system, this command displays uRPF configuration for all IRF member devices and PEXs if you do not specify an IRF member device or PEX. (Centralized IRF devices.) (IRF 3 capable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays uRPF configuration for all cards. (Distributed devices in IRF mode.) (IRF 3 incapable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device or specifies a PEX. The chassis-number argument represents the member ID of the IRF member device or the virtual chassis number of the PEX. The slot-number argument represents the slot number of the card or PEX. On an IRF fabric, this command displays uRPF configuration for all cards if you do not specify a card. On an IRF 3 system, this command displays uRPF configuration for all cards and PEXs if you do not specify a card or PEX. (Distributed devices in IRF mode.) (IRF 3 capable.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot.

Examples

# Display uRPF configuration for the specified security zone.

<Sysname> display ip urpf security-zone Untrust

uRPF configuration information of security-zone Untrust(failed):

Check type: strict

Allow default route

Link check

Suppress drop ACL: 3000

Table 2 Command output

Field | Description
(failed) | The system failed to deliver the uRPF configuration to the forwarding chip because of insufficient chip resources. This field is not displayed if the delivery is successful.
Check type | uRPF check mode: loose or strict.
Allow default route | Using the default route is allowed.
Link check | Link layer check is enabled.
Suppress drop ACL | ACL used for drop suppression.

IPv4 uRPF commands -- ip urpf

Use ip urpf to enable uRPF.

Use undo ip urpf to disable uRPF.

Syntax

ip urpf { loose [ allow-default-route ] [ acl acl-number ] | strict [ allow-default-route ] [ acl acl-number ] [ link-check ] }

undo ip urpf

Default

uRPF is disabled.

Views

System view

Interface view

Security zone view

Predefined user roles

network-admin

mdc-admin

Parameters

loose: Enables loose uRPF check. To pass loose uRPF check, the source address of a packet must match the destination address of a FIB entry.

strict: Enables strict uRPF check. To pass strict uRPF check, the source address and receiving interface of a packet must match the destination address and output interface of a FIB entry. You can enable strict uRPF check only in VLAN interface view.

allow-default-route: Allows using the default route for uRPF check.

acl acl-number: Specifies an ACL by its number.

· For a basic ACL, the value range is 2000 to 2999.

· For an advanced ACL, the value range is 3000 to 3999.

link-check: Enables link layer check (Ethernet link).

Usage guidelines

uRPF can be deployed on a PE connected to a CE or an ISP, or on a CE.

Configure strict uRPF check for traffic that uses symmetric path and configure loose uRPF check for traffic that uses asymmetric path. A symmetric path exists for a session if the PE uses the same interface to receive upstream traffic and send downstream traffic. The path is asymmetric if the PE uses different interfaces to receive upstream traffic and send downstream traffic.

· Typically, symmetric path applies to traffic that goes through an ISP's PE interface connected to the CE. You can configure strict uRPF check on the PE interface or for the security zone to which the PE interface belongs.

· Asymmetric path might exist for traffic that goes through a PE interface connected to another ISP. In this case, configure loose uRPF check on the PE interface or for the security zone to which the PE interface belongs.

Typically, you do not need to configure the allow-default-route keyword on a PE device, because it has no default route pointing to a CE. If you enable uRPF on a CE that has a default route pointing to the PE, specify the allow-default-route keyword.

You can use an ACL to match specific packets, so they are forwarded even if they fail to pass uRPF check.

If a Layer 3 PE interface connects to a large number of PCs, configure the link-check keyword on the interface to enable link layer check. uRPF checks the validity of the source MAC address.

Examples

# Enable strict uRPF check globally.

<Sysname> system-view

[Sysname] ip urpf strict

# Configure loose uRPF check on interface GigabitEthernet 1/0/1. (Applicable to routers.)

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] ip urpf loose

# Configure loose uRPF check on VLAN-interface 10. (Applicable to switches.)

<Sysname> system-view

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] ip urpf loose

# Configure strict uRPF check for security zone Untrust.

<Sysname> system-view

[Sysname] security-zone name Untrust

[Sysname-security-zone-Untrust] ip urpf strict

Related commands

display ip urpf

IPv6 uRPF commands -- display ipv6 urpf

Use display ipv6 urpf to display IPv6 uRPF configuration.

Syntax

Centralized devices:

display ipv6 urpf [ interface interface-type interface-number ]

Distributed devices in standalone mode:Centralized IRF devices:

display ipv6 urpf [ interface interface-type interface-number ] [ slot slot-number [ cpu cpu-number ] ]

Distributed devices in IRF mode:

display ipv6 urpf [ interface interface-type interface-number ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

interface interface-type interface-number: Specifies an interface by its type and number.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays IPv6 uRPF configuration for all cards. (Distributed devices in standalone mode.)

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays IPv6 uRPF configuration for all member devices. (Centralized IRF devices.) (IRF 3 incapable.)

slot slot-number: Specifies an IRF member device by its member ID or specifies a PEX by its virtual slot number. On an IRF fabric, this command displays IPv6 uRPF configuration for all member devices if you do not specify a member device. On an IRF 3 system, this command displays IPv6 uRPF configuration for all IRF member devices and PEXs if you do not specify an IRF member device or PEX. (Centralized IRF devices.) (IRF 3 capable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays IPv6 uRPF configuration for all cards. (Distributed devices in IRF mode.) (IRF 3 incapable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device or specifies a PEX. The chassis-number argument represents the member ID of the IRF member device or the virtual chassis number of the PEX. The slot-number argument represents the slot number of the card or PEX. On an IRF fabric, this command displays IPv6 uRPF configuration for all cards if you do not specify a card. On an IRF 3 system, this command displays IPv6 uRPF configuration for all cards and PEXs if you do not specify a card or PEX. (Distributed devices in IRF mode.) (IRF 3 capable.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot.

Examples

# (Centralized devices.) Display IPv6 uRPF configuration on the specified interface. (Applicable to routers.)

<Sysname> display ipv6 urpf interface gigabitethernet 1/0/1

IPv6 uRPF configuration information of interface GigabitEthernet1/0/1(failed):

Check type: loose

Allow default route

Suppress drop ACL: 2000

# (Centralized devices.) Display IPv6 uRPF configuration on the specified interface. (Applicable to switches.)

<Sysname> display ipv6 urpf interface vlan-interface 10

IPv6 uRPF configuration information of interface Vlan-interface10(failed):

Check type: loose

Allow default route

Suppress drop ACL: 2000

# (Centralized devices.) Display IPv6 uRPF configuration.

<Sysname> display ipv6 urpf

Global IPv6 uRPF configuration information(failed):

Check type: strict

Allow default route

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Display IPv6 uRPF configuration for the specified slot.

<Sysname> display ipv6 urpf slot 1

Global IPv6 uRPF configuration information(failed):

Check type: strict

Allow default route

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Display IPv6 uRPF configuration on the specified interface. (Applicable to routers.)

<Sysname> display ipv6 urpf interface gigabitethernet 1/0/1 slot 1

IPv6 uRPF configuration information of interface GigabitEthernet1/0/1(failed):

Check type: loose

Allow default route

Suppress drop ACL: 2000

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Display IPv6 uRPF configuration on the specified interface. (Applicable to switches.)

<Sysname> display ipv6 urpf interface vlan-interface 10 slot 1

IPv6 uRPF configuration information of interface Vlan-interface10(failed):

Check type: loose

Allow default route

Suppress drop ACL: 2000

Table 3 Command output

Field | Description
(failed) | The system failed to deliver the IPv6 uRPF configuration to the forwarding chip because of insufficient chip resources. This field is not displayed if the delivery is successful.
Check type | IPv6 uRPF check mode: loose or strict.
Allow default route | Using the default route is allowed.
Suppress drop ACL | IPv6 ACL used for drop suppression.

IPv6 uRPF commands -- display ipv6 urpf security-zone

Use display ipv6 urpf security-zone to display IPv6 uRPF configuration.

Syntax

Centralized devices:

display ipv6 urpf security-zone zone-name

Distributed devices in standalone mode:Centralized IRF devices:

display ipv6 urpf security-zone zone-name [ slot slot-number [ cpu cpu-number ] ]

Distributed devices in IRF mode:

display ipv6 urpf security-zone zone-name [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

zone-name: Specifies a security zone by its name, a case-insensitive string of 1 to 31 characters. The string cannot include hyphens (-).

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays IPv6 uRPF configuration for all cards. (Distributed devices in standalone mode.)

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays IPv6 uRPF configuration for all member devices. (Centralized IRF devices.) (IRF 3 incapable.)

slot slot-number: Specifies an IRF member device by its member ID or specifies a PEX by its virtual slot number. On an IRF fabric, this command displays IPv6 uRPF configuration for all member devices if you do not specify a member device. On an IRF 3 system, this command displays IPv6 uRPF configuration for all IRF member devices and PEXs if you do not specify an IRF member device or PEX. (Centralized IRF devices.) (IRF 3 capable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays IPv6 uRPF configuration for all cards. (Distributed devices in IRF mode.) (IRF 3 incapable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device or specifies a PEX. The chassis-number argument represents the member ID of the IRF member device or the virtual chassis number of the PEX. The slot-number argument represents the slot number of the card or PEX. On an IRF fabric, this command displays IPv6 uRPF configuration for all cards if you do not specify a card. On an IRF 3 system, this command displays IPv6 uRPF configuration for all cards and PEXs if you do not specify a card or PEX. (Distributed devices in IRF mode.) (IRF 3 capable.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot.

Examples

# Display IPv6 uRPF configuration for the specified security zone.

<Sysname> display ipv6 urpf security-zone Untrust

IPv6 uRPF configuration information of security-zone Untrust(failed):

Check type: loose

Allow default route

Suppress drop ACL: 2000

Table 4 Command output

Field | Description
(failed) | The system failed to deliver the IPv6 uRPF configuration to the forwarding chip because of insufficient chip resources. This field is not displayed if the delivery is successful.
Check type | IPv6 uRPF check mode: loose or strict.
Allow default route | Using the default route is allowed.
Suppress drop ACL | IPv6 ACL used for drop suppression.

IPv6 uRPF commands -- ipv6 urpf

Use ipv6 urpf to enable IPv6 uRPF.

Use undo ipv6 urpf to disable IPv6 uRPF.

Syntax

ipv6 urpf { loose | strict } [ allow-default-route ] [ acl acl-number ]

undo ipv6 urpf

Default

IPv6 uRPF is disabled.

Views

System view

Interface view

Security zone view

Predefined user roles

network-admin

mdc-admin

Parameters

loose: Enables loose IPv6 uRPF check. To pass loose IPv6 uRPF check, the source address of a packet must match the destination address of an IPv6 FIB entry.

strict: Enables strict IPv6 uRPF check. To pass strict IPv6 uRPF check, the source address and receiving interface of a packet must match the destination address and output interface of an IPv6 FIB entry.

allow-default-route: Allows using the default route for IPv6 uRPF check.

acl acl-number: Specifies an IPv6 ACL by its number.

· For a basic IPv6 ACL, the value range is 2000 to 2999.

· For an advanced IPv6 ACL, the value range is 3000 to 3999.

Usage guidelines

IPv6 uRPF can be deployed on a CE or on a PE connected to either a CE or an ISP.

Configure strict IPv6 uRPF check for traffic that uses symmetric path and configure loose IPv6 uRPF check for traffic that uses asymmetric path. A symmetric path exists for a session if the PE uses the same interface to receive upstream traffic and send downstream traffic. The path is asymmetric if the PE uses different interfaces to receive upstream traffic and send downstream traffic.

· Typically, symmetric path applies to traffic that goes through an ISP's PE interface connected to the CE. You can configure strict IPv6 uRPF check on the PE interface or for the security zone to which the PE interface belongs.

· Asymmetric path might exist for traffic that goes through a PE interface connected to another ISP. In this case, configure loose IPv6 uRPF check on the PE interface or for the security zone to which the PE interface belongs.

Typically, you do not need to configure the allow-default-route keyword on a PE device, because it has no default route pointing to a CE. If you enable uRPF on a CE that has a default route pointing to the PE, specify the allow-default-route keyword.

You can use an ACL to match specific packets, so they are forwarded even if they fail to pass IPv6 uRPF check.

Examples

# Enable strict IPv6 uRPF check globally.

<Sysname> system-view

[Sysname] ipv6 urpf strict

# Configure loose IPv6 uRPF check on interface GigabitEthernet 1/0/1. (Applicable to routers.)

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] ipv6 urpf loose

# Configure loose IPv6 uRPF check on VLAN-interface 10. (Applicable to switches.)

<Sysname> system-view

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] ipv6 urpf loose

# Configure loose IPv6 uRPF check for the security zone Untrust.

<Sysname> system-view

[Sysname] security-zone name Untrust

[Sysname-security-zone-Untrust] ipv6 urpf loose

Related commands

display ipv6 urpf