← Back to Nokia Service Router OS 25.x Router Security Technical Implementation Guide

V-283839

CAT II (Medium)

The Nokia Provider Edge (PE) router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all Customer Edge (CE)-facing interfaces.

Rule ID

SV-283839r1203766_rule

STIG

Nokia Service Router OS 25.x Router Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001097

Discussion

The uRPF feature is a defense against spoofing and denial-of-service attacks by verifying if the source address of any ingress packet is reachable. To mitigate attacks that rely on forged source addresses, all PE routers must enable uRPF loose mode to guarantee that all packets received from a CE router contain source addresses that are in the route table.

Check Content

Review the router configuration to determine if uRPF loose mode is enabled on all CE-facing interfaces, as shown in the example below.

Verify "uRPF Chk" is set to "enabled" and "uRPF Chk Mode" is set to "loose":

- show router interface "TO-CE" detail | match "uRPF Chk"

uRPF Chk         : enabled              uRPF Chk Mode     : loose

If "uRPF Chk" is not enabled and "uRPF Chk Mode" is not set to "loose" on all CE-facing interfaces, this is a finding.

Fix Text

Enable uRPF "loose" mode on all CE-facing interfaces, as shown in the example below: 

- configure router interface "TO-CE" urpf-check mode loose