HP 6125G HP 6125G & 6125G/XG Blade Switches Security Configuration Gui - Page 267

{ If yes, proceeds to step 5. { If not, proceeds to step 4. 4. URPF checks whether the receiving interface matches the output interface of the matching FIB entry. { If yes, proceeds to step 8. { If not, proceeds to step 9. 5. URPF checks whether the source IP address matches an ARP entry. { If yes, proceeds to step 8. { If not, proceeds to step 9. 6. URPF checks whether the FIB table has a default route. { If yes, proceeds to step 7. { If not, proceeds to step 9. 7. URPF checks whether the output interface of the default route matches the receiving interface of the packet. { If yes, proceeds to step 8. { If not, proceeds to step 9. 8. The packet passes the check and is forwarded. 9. The packet is discarded. Configuring URPF To configure URPF globally: Step 1. Enter system view. 2. Enable URPF check globally. Command system-view ip urpf strict } Remarks N/A Disabled by default NOTE: • The routing table size decreases by half when URPF is enabled on the HP 6125 Blade switches. • To prevent loss of routes and packets, URPF cannot be enabled if the number of route entries the switch maintains exceeds half the routing table size. URPF configuration example Network requirements As shown in Figure 82, a client (Switch A) directly connects to the ISP switch (Switch B). Enable URPF check on Switch A and Switch B to prevent source address spoofing attacks. Figure 82 Network diagram 257