Title

The RUCKUS ICX PE router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces. (Cat II impact)

Discussion

The uRPF feature is a defense against spoofing and denial-of-service (DoS) attacks by verifying if the source address of any ingress packet is reachable. To mitigate attacks that rely on forged source addresses, all provider edge routers must enable uRPF loose mode to guarantee that all packets received from a CE router contain source addresses that are in the route table.

Check Content

Review the router configuration to determine if uRPF loose mode is enabled on all CE-facing interfaces. 1. Check that RPF is configured globally (requires reload when initially set). reverse-path-check 2. Review the router configuration to determine if uRPF loose mode is enabled on all CE-facing interfaces. Interface ethernet 1/1/1 rpf-mode loose If uRPF loose mode is not enabled on all CE-facing interfaces, this is a finding.

Fix Text

Enable uRPF loose mode on all CE-facing interfaces. 1. Configure reverse-path-check globally. ICX(config)#reverse-path-check reverse-path-check setting changes requires a reload to take effect! NOTE: Configuring reverse-path-check reduces following system-max by half. Following system-max will be reset to default. Please configure them after reload Please adjust/remove max-route configuration in any vrf before reload. Ip-route,ip6-route, ip-route-default-vrf, ip6-route-default-vrf, ip-route-vrf, ip6-route-vrf 2. Configure uRPF mode on CE interface(s). ICX(config)#interface ethernet 1/1/1 ICX(config-if-e10000-1/1/1)#rpf-mode loose

Additional Identifiers

Rule ID: SV-273612r1110923_rule

Vulnerability ID: V-273612

Group Title: SRG-NET-000205-RTR-000008

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.