And welcome back in this video. You and I get to implement unicast reverse path
forwarding checks and by George
This is an amazing feature that you're gonna love the way that unicast
RPF checks work is that the router is gonna take a little additional time and
peek at the source address and then
Decide whether it wants to continue forwarding that packet or not so as an
example our 72 has a loop packet rest of 72
Etc 72 72 72 etc and our seven has learned about that route via an interior
gateway routing protocol
And it knows that to get to that network. It's gonna forward it this way now WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it knows that to get to that network. It's gonna forward it this way now
I suppose this link went down it would then if that link was no longer there
It was still being dynamically learned then it would go ahead and forward this
way
But in either case that network of 72 etc is gonna be reachable off of gig zero
plus two or gig zero plus three
Based on the routing table of our seven so let's imagine
There's a packet coming through the network and it's destined to 72 dot 72 dot
72 dot 72 that's the destination address
So let's imagine our six is sourcing that and this is the 23 dot 67 network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's imagine our six is sourcing that and this is the 23 dot 67 network
So if it just sourced it from this interface the source address would be 23 dot
67 dot 0 dot 6
And if we don't yet have unit cast RPF checking enabled on this interface our
seven when it gets the packet
We just look at the destination address look at the surrounding table
It's all cached and stuff but effectively based on the information in the
routing table make a forwarding decision and send it on its way
Now what happens if there's an attacker who?
Modifies the source address and says hey, you know what the source address is
73 dot 73 dot 73 dot 73 dot 73 so that's an example of a spoof source address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
73 dot 73 dot 73 dot 73 dot 73 so that's an example of a spoof source address
because
73 is the loopback address over here on our 73 once again without the unit cast
RPF checks in place here on our seven
Our seven would get the packet say oh it's destined to 72 72 etc
And then it would forward the packet up to our 72 who would get the packet say
oh this came from 73 73
And then it would reply back to this device or even worse if this is a
distributed denial of service attack
And we're doing TCP send requests against this victim and then he's responding WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we're doing TCP send requests against this victim and then he's responding
back. We're now have two victims
We have our 72 and we have our 73 that's getting all the responses coming back
from our 72 when in reality our 73 never made
Those requests in the first place. It's just because we have spoofed source
addresses right here
So one way of solving that would be to go ahead and put an access control list
here in our seven
This says if traffic is sourced from and then we include all the address space
We have over here then go ahead and drop it
But a much better and more elegant way of doing that would be using this
dynamic feature called unit cast RPF checks
So if we enable RPF checks on the center face gig zero slash one now in those WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we enable RPF checks on the center face gig zero slash one now in those
packets come into our seven on gig zero
Slash one and it has a route for the 72 72 72 before it makes that forwarding
decision and actually forwards traffic
It's also gonna peak at the source address and it's gonna ask itself the
question
Hmm just just what if if I was going to forward a packet to 73 73 73 73
Would I use this interface the one that the packet came in on to reach back to
that client and based on the routing table
The answer is no it would be using this interface down here to our 73 and as a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The answer is no it would be using this interface down here to our 73 and as a
result that would fail this unit cast RPF check
And our seven would drop the packet right there wouldn't continue to forward it
because of the bogus or non-agreeing
source address based on a shrouding table now in that example
That's referred to as strict checking effectively
It says hey this one interface right here when the packet came in is that the
exact interface?
I would use to reach back to that source address and that's referred to as a
strict check
However in large environments we often have redundancy and we have more than
one possible interface
So there's another option called loose and with loose it effectively says when WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So there's another option called loose and with loose it effectively says when
the packet comes in
I'm gonna peek at the source address and if I have a route for that source
address off any interface
I'm going to go ahead and allow it so hence that's why it's called loose
It's not as restrictive as the exact interface where that packet came in
So I'm gonna put right here have a route in fib forward information base
And that's pretty much the two major options we have with unit cast RPF checks
strict on the exact interface or loose
Meaning we have a route in the routing table and there is one additional option
and that is we can include an access control list to make exceptions WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and that is we can include an access control list to make exceptions
So we could apply unit cast RPF checks on this interface and say you know what
by the way
Before you drop the packet and not forward it
If it's coming from and you can list in an access control list the addresses
that you want to go ahead and be forwarded
Anyway, and it's as simple as creating the access control list that identifies
the exception that you want to make and then including that
Access control list as part of our configuration on the interface. So as a game
plan, let's do this
Let's go ahead and use the target of 72 the 72.72.72.72 and let's spoof the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's go ahead and use the target of 72 the 72.72.72.72 and let's spoof the
address of 73.73
That's 73 that's 73 from some device out here
And then we'll forward the packet to that address of 72 72 72 72 so once we
enable the RPF checking here our seven
Should say you know what I'm not following that traffic because the source
address is messed up based on the routing table
I have so let's start right here on our seven
Let's just do a quick check of our routing table
So to show IP route and so I want to verify that to get to the 72 72 72 72 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So to show IP route and so I want to verify that to get to the 72 72 72 72
We would be using interface gigabit zero plus two for our routing decision
So let me just check our interfaces real quick
So yeah, zero plus two leads up to 72 etc
And then zero slash one would be the ingress interface for all that traffic
coming into ASF
And let's do a quick look at the configuration on gig zero slash one with a
show interface gig
Zero slash one and let's also do a show IP interface for gig zero slash one
So down here at the bottom it doesn't indicate that it currently has any WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So down here at the bottom it doesn't indicate that it currently has any
RPF checks in place and we can also look at the running config for it show run
interface gig
Zero slash one to confirm that as well and we can also do a show IP stuff
switching statistics feature
Press center also for fun. Let's go ahead and set up an attack from our six
So here on our six if we create a loop back of this isn't very nice
But we'll create a loop back address of
73 dot 73 dot 73 and then we can send traffic into autonomous system seven
sourcing it from this 73 address base WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sourcing it from this 73 address base
And let's set that up first as a pretest and then we'll go ahead and set up the
RPF checking here on our seven
So here on our six let's go into configuration mode and let's create interface
loop back and let's see what we currently have is to do show
IP interface brief and let's create loop back 73 so we'll do interface loop
back
73 we'll give it the IP address that we're gonna spoof from and this way
We're allowing the router without any attack tools to basically spoof an IP
address that's used elsewhere in the network
So we'll give it the IP address of 73 dot 73 dot 73 dot 73 and we'll give it a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll give it the IP address of 73 dot 73 dot 73 dot 73 and we'll give it a
32 bit mask just like that
And let's do a ping out to 72 dot 72 dot 72 dot 72 which is which is a router
72 loop back address
But we'll source it from our loop back and we'll press enter now
the reason the reason this isn't working is because if it's being routed by our
seven which I believe it is the
Responses are going back to our 73 because we spoofed the source IP address
So I'm gonna do that once again and over on our 73
I turned on debugging for ICMP traffic and what should be happening is this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I turned on debugging for ICMP traffic and what should be happening is this
We should have the traffic that's being sent from our six being routed through
our seven to our 72 with a spoof source address
So the replies should be going back to our 73 from those things
So we can verify that by making a road trip over to our 73 and sure enough echo
replies coming from 72 72 72 72 72
So to prevent this we're gonna set up unique asked rpf checks right here on our
seven on gig zero one
So here on our seven we'll go into configuration mode interface a gig
Zero slash one and we'll enable unique asked rpf checks right here and here's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Zero slash one and we'll enable unique asked rpf checks right here and here's
the syntax
It's IP verify
Unicast source and we're gonna say reachable via and this is how we control
whether it's strict or whether it's loose
And here's the options we have any which simply says hey the source address
I have to have an entry in my fib of forwarding information base
And if I do that's cool the packet can flow
So that's if we said any or if we wanted to make it literal for this specific
interface as far as the return path
We would just say our X and that's how we would implement these strict rpf WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We would just say our X and that's how we would implement these strict rpf
check
And then we can do a question mark and if we had exceptions to that for example
certain networks that we didn't want to have to go to the check
We could actually have an access control list that identifies those networks
and then include it right here
So to start off
Let's just go ahead and use it like this also another we have rpf checks
enabled
Let's do a show IP interface for gig zero slash one now
We did this previously, but it didn't have this additional information at the
bottom because it wasn't yet enabled
So at the moment we don't have any drops as a result of the rpf checks, but we
're about to change that
All right, so let's try to send some spoof traffic once again WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, so let's try to send some spoof traffic once again
So here at router 73
We still have the debugging in place if that traffic makes it through and the
replies come back to our 73
They should show up here and let's go back to our six and let's hit the up
arrow key
And let's do that ping once again now still spoof traffic, but I don't see our
73 the icons not changing
It's not getting those responses and that's because we're killing the traffic
at our seven
So we can verify that by going back to our seven and hitting the up arrow key
for show IP interface for gig zero slash one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for show IP interface for gig zero slash one
Press Center if we go down here
We have five verification drops because the source address didn't pan out with
the routing table as far as how to reach that source address
And as a result didn't pass the check and that traffic was dropped
Also, if we did this command show IP self switching statistics feature in press
center check this out now at the top that
We have some drops now it's showing unit cast rpf drops right here
Now one other cool option is this if we wanted to get information like how
often is this happening?
We certainly could use these commands for example the show IP interface and the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We certainly could use these commands for example the show IP interface and the
show IP self switching
But we could also create an access control list not to exclude or permit
certain routes from failing the rpf check
But just to add the log feature sort of like having at the end of an access
list before the implicit deny having a statement
That says deny IP any any log so you can record that information
We can do a similar concept here by attaching an access list to the rpf command
just for the benefit of the log information
So let's do that right now. So here on router 7 let's do a show access list
See what I currently have in place and we have access list 77 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
See what I currently have in place and we have access list 77
So let's create a new access list. Let's create access list 100
So we'll go into configuration mode and let's do access list 100 and let's say
deny
Because we don't want to make exceptions to the rpf rule
But we want the logging so we'll say deny IP any any and then we'll use the
keyword of log
And now that we have that access control list we can associate that with the rp
f commands that we did on gig zero
Slash one so let's do a do show run interface gig
Zero slash one will hop over there interface gig zero slash one and we'll do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Zero slash one will hop over there interface gig zero slash one and we'll do
the same command again
Except this time we'll tack on the access list of 100
So let's do a show IP interface for gig zero slash one
So here's showing us that we're doing the strict checking on that interface and
we're using access list 100
And once again, we're not allowing any specific packets to bypass the check
But we will get the logging information as a result in fact, let me go ahead
and turn on terminal monitor
So we can actually see what's going on as well. All right, let's go back to our
six and let's load it up
In fact, let's do a ping
72 72 72 72 source loopback 73. Let's repeat this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
72 72 72 72 source loopback 73. Let's repeat this
About 10,000 times and let's also specify the timeout and let's go ahead say
timeout of zero
This I can turn your Cisco device into a killing machine
Basically, it's gonna spit out iced and p request as fast as it can
It's not gonna even wait for a response
So we'll go ahead and launch that and that's cranking away. That'll be how many
did I say 10,000?
Yeah, that'll take a minute. So if we go back here to our seven, oh, there we
go
So the logging matched on the first packet gave us the message WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the logging matched on the first packet gave us the message
And then in about five minutes
It's gonna give us another message with the sum of how many times that happened
since the first one
And that way we don't have a separate log message for every single time it
happens
Which is kind of convenient
So if we had the upper key a few times let's do a show ip interface for gig
zero slash one hit space
Look at that
8,000 218 verification drops and if we hit the upper key again
It's growing as those drops continue to happen in the background
And if we went back to the show ip self switching statistics feature and press
dinner
There we go 10,000 and five right there WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There we go 10,000 and five right there
So in this video, we've done a plan
implementation and verification of rpf checks for unicast traffic on a Cisco
router
I hope this has been informative and I'd like to thank you for viewing