Re: [c-nsp] Purposed of uRPF's "allow-default" Option?

2010-01-29 Thread Antonio Querubin
On Fri, 29 Jan 2010, Devon True wrote: So it is for the situation where you do not have a full table (so strict and/or loose mode would not work), but you want uRPF on the edge to be able to drop packets whose network is routed to null on your FIB? To be able to accept and forward (not drop) p

Re: [c-nsp] Purposed of uRPF's "allow-default" Option?

2010-01-29 Thread Tim Stevenson
Hi Devon - With loose mode uRPF ("reachable-via any"), "allow-default" does mean that any packet will pass the uRPF check (unless the default route goes away). However, with strict mode uRPF ("reachable-via rx") with allow-default, traffic not matching a more specific prefix only passes the R

Re: [c-nsp] Purposed of uRPF's "allow-default" Option?

2010-01-29 Thread Devon True
On 1/29/2010 4:57 PM, Antonio Querubin wrote: > On Fri, 29 Jan 2010, Antonio Querubin wrote: > >> Yes but that's not the interface where you would apply it. You apply > ^ >necessarilly >> 'allow-default' on your upstream interface that you point your default >>

Re: [c-nsp] Purposed of uRPF's "allow-default" Option?

2010-01-29 Thread Antonio Querubin
On Fri, 29 Jan 2010, Antonio Querubin wrote: Yes but that's not the interface where you would apply it. You apply ^ necessarilly 'allow-default' on your upstream interface that you point your default route to. Ie. if you set your default-route at a particul

Re: [c-nsp] Purposed of uRPF's "allow-default" Option?

2010-01-29 Thread Antonio Querubin
On Fri, 29 Jan 2010, Devon True wrote: I am curious what the purpose of uRPF's "allow-default" option is? Based on Cisco's page explaining the command, I interpret that it allows uRPF to match on a default route... but doesn't that defeat the purpose of uRPF? See below. interface Vlan100 ip

[c-nsp] Purposed of uRPF's "allow-default" Option?

2010-01-29 Thread Devon True
All: I am curious what the purpose of uRPF's "allow-default" option is? Based on Cisco's page explaining the command, I interpret that it allows uRPF to match on a default route... but doesn't that defeat the purpose of uRPF? My best guess is that it allows you to set static routes for networks w