Discussion

configured on interfaces that the default route uses, so it may not be a good fit in
your network for this reason.
To verify the configuration, look at the statistics on the logical interface:
aviva@router1> show interfaces so-0/0/0.0 statistics
Logical interface so-0/0/0.0 (Index 67) (SNMP ifIndex 41)
Flags: Point-To-Point SNMP-Traps Encapsulation: PPP
Protocol inet, MTU: 4470
Flags: uRPF
RPF Failures: Packets: 23, Bytes: 2492
Addresses, Flags: Is-Preferred Is-Primary
Destination: 10.1.12.0/30, Local: 10.1.12.1, Broadcast: 10.1.12.3
Protocol iso, MTU: 4470
Flags: Is-Primary
Protocol mpls, MTU: 4458
Flags: Is-Primary
The Flags field shows that unicast RPF is enabled, and the next line shows the number
of packets and bytes dropped because of unicast RPF checks.
When you think the router is experiencing a DoS attack, set up a firewall filter to
count the packets dropped by the interface. Create a separate filter to count the unicast
RPF traffic:
[edit firewall]
aviva@router1# set filter rpf-filter term default then count rpf-failed-count
aviva@router1# set filter rpf-filter term default then reject
aviva@router1# show
filter rpf-filter {
term default {
then {
count rpf-failed-count;
reject;
}
}
}
This filter has no from clause, so it applies to all incoming packets. The then clause
creates a file named rpf-failed-count and rejects all packets. Then apply the filter to
the interface:
[edit interfaces so-0/0/0]
aviva@router1# set unit 0 family inet rpf-check fail-filter rpf-filter
Reference the filter you created in the fail-filter option of the rpf-check statement.
Unicast RPF filters are not part of the normal firewall filter on an interface but
are handled separately. They are evaluated after input filters and before output filters.
Unicast RPF looks only in the inet.0 routing table for IPv4 packets and the
inet6.0 table for IPv6 packets, so if an interface’s input filter forwards packets to a
different routing table, the unicast RPF check is not performed.
268 | Chapter 8: IP Routing
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.