[c-nsp] Loose uRPF behaving like strict mode on 7600
Jose
lobo at allstream.net
Wed Apr 29 23:27:22 EDT 2009
I was wondering if someone might have an explanation as to why we
encountered an issue with uRPF (loose mode) when we tried enabling it on
our upstream facing links. We have 2 x 7603s w/ SUP32 acting as our Gwy
routers and our transit providers connect into them (one on each gwy +
private peers). We are fed from each of them the entire internet table
along with a default route.
Now I know that we are multi-homed and obviously have asymmetrical
routing occurring so I decided to implement loose uRPF on the
interfaces: ip verify unicast source reachable-via any
However shortly after enabling it we got calls that our customers could
not reach parts of the internet. Specifically destinations where the
packets would travel over the links that had RPF enabled on them and
were our transits. Traffic to and from our private peers appeared fine
though with RPF. Pings to our internal CIDRs from external
route-servers would fail as well so long as the path was over the
transits. Disabling RPF on the interfaces resolved the problem immediately.
From my understanding of this feature, it would seem as if the RPF
check was working in strict mode vs loose mode. Could there have been
something that we missed? Should the "allow-default" be used in this
case? I've never had to use it before when I've implemented loose mode
in other environments.
The 7603s are running 12.2(18)SXF11 Advanced IP Services.
Thanks for any feedback.
Jose
More information about the cisco-nsp
mailing list