350-501 practice question 29 of 35

A network operator working for a private outsourcing company with an employee id: 4261:72:778 needs to limit the malicious traffic on their network. Which configuration must the engineer use to implement URPF loose mode on the GigabitEthernet0/1 interface?

Domain Networking

Answer options

A. router(config)# interface gigabitethernet0/1 router(config-if)# ip address 192.168.200.1 255.255.255.0 router(config-if)# ip verify unicast source reachable-via any router(config-if)# ipv6 address 2001:DB8:1::1/96 router(config-if)# ipv6 verify unicast source reachable-via any

Correct answer

B. router(config)# interface gigabitethernet0/1 router(config-if)# ip address 192.168.200.1 255.255.255.0 router(config-if)# ip verify unicast source reachable-via rx router(config-if)# ipv6 address 2001:DB8:1::1/96 router(config-if)# ipv6 verify unicast source reachable-via rx

C. router(config)# interface gigabitethernet0/1 router(config if)# ip address 192.168.200.1 255.255.255.0 router(config-if)# ip verify unicast source reachable-via rx router(config-if)# ipv6 address 2001:DB8:1::1/96 router(config-if)# ipv6 verify unicast source reachable-via any

D. router(config)# interface gigabitethernet0/1 router(config-if)# ip address 192.168.200.1 255.255.255.0 router(config-if)# ip verify unicast source reachable-via any router(config-if)# ipv6 address 2001:DB8:1::1/96 router(config-if)# ipv6 verify unicast source reachable-via rx

Correct Answer:

A. A. router(config)# interface gigabitethernet0/1 router(config-if)# ip address 192.168.200.1 255.255.255.0 router(config-if)# ip verify unicast source reachable-via any router(config-if)# ipv6 address 2001:DB8:1::1/96 router(config-if)# ipv6 verify unicast source reachable-via any

Explanation

Unicast Reverse Path Forwarding (uRPF) is a security feature that mitigates problems caused by malformed or forged IP source addresses. The question requires implementing uRPF in "loose mode." In loose mode, the router checks if the source IP address of an incoming packet has a route in the Forwarding Information Base (FIB). It does not matter which interface the route points to. The command syntax for enabling loose mode on an interface for both IPv4 and IPv6 is [ip|ipv6] verify unicast source reachable-via any. Option A correctly applies this command for both address families on the specified interface.

Why Incorrect

B: This option configures uRPF in "strict mode" (reachable-via rx) for both IPv4 and IPv6, which checks if the source is reachable specifically via the ingress interface. C: This option incorrectly mixes modes, configuring "strict mode" (rx) for IPv4 and "loose mode" (any) for IPv6, failing to meet the requirement for the entire interface. D: This option also incorrectly mixes modes, configuring "loose mode" (any) for IPv4 and "strict mode" (rx) for IPv6, which is inconsistent with the requirement.

References

1. Cisco Systems

Inc. (2023). IP Addressing: IPv4 Configuration Guide

Cisco IOS XE 17. "Configuring Unicast RPF" section. This document specifies the command syntax: ip verify unicast source reachable-via {rx | any}. It explicitly states

"any: Enables loose Unicast RPF check. The source address of the packet must be reachable."

2. Cisco Systems

Inc. (2023). IPv6 Configuration Guide

Cisco IOS XE 17. "Implementing Unicast RPF for IPv6" section. This guide confirms the equivalent command for IPv6: ipv6 verify unicast source reachable-via {rx | any} and defines the any keyword for loose mode operation.

3. Baker

& Savola

P. (March 2004). RFC 3704: Ingress Filtering for Multihomed Networks. The Internet Society. Section 2

"Feasibility checks

" describes the two modes of operation. "Loose RPF" corresponds to the check where a route to the source exists

which is implemented by the reachable-via any command. (DOI: https://doi.org/10.17487/RFC3704)

Keep practicing

Take the free 350-501 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test