nerdexam
Cisco

300-410 · Question #99

Refer to the exhibit. Which option represents the minimal configuration that allows inbound traffic from the 172.16.1.0/24 network to successfully enter router R, while also limiting spoofed…

The correct answer is A. (config)#ip cef (config)#interface fa0/0 (config)#ip verify unicast source reachable-via rx allow-default. To allow legitimate inbound traffic from 172.16.1.0/24 and block spoofed 10.0.0.0/8 traffic on router R's Fa0/0 interface, Unicast Reverse Path Forwarding (uRPF) in loose mode must be configured, along with enabling CEF.

Infrastructure Security

Question

Refer to the exhibit. Which option represents the minimal configuration that allows inbound traffic from the 172.16.1.0/24 network to successfully enter router R, while also limiting spoofed 10.0.0.0/8 hosts that could enter router R? Fa0/0 192.168.1.5 Fa0/1 10.1.1.5 R R(config)#ip route 10.0.0.0 255.0.0.0 FastEthernet0/1 R(config)#ip route 0.0.0.0 0.0.0.0 FastEthernet 0/0

Options

  • A(config)#ip cef (config)#interface fa0/0 (config)#ip verify unicast source reachable-via rx allow-default
  • B(config)#ip cef (config)#interface fa0/0 (config)#ip verify unicast source reachable-via rx
  • C(config)#no ip cef (config)#interface fa0/0 (config-if)#ip verify unicast source reachable-via rx
  • D(config)#interface fa0/0 (config-if)#ip verify unicast source reachable-via any

How the community answered

(22 responses)
  • A
    82% (18)
  • B
    9% (2)
  • C
    5% (1)
  • D
    5% (1)

Why each option

To allow legitimate inbound traffic from 172.16.1.0/24 and block spoofed 10.0.0.0/8 traffic on router R's Fa0/0 interface, Unicast Reverse Path Forwarding (uRPF) in loose mode must be configured, along with enabling CEF.

A(config)#ip cef (config)#interface fa0/0 (config)#ip verify unicast source reachable-via rx allow-defaultCorrect

The `ip verify unicast source reachable-via rx allow-default` command, applied to the Fa0/0 interface, enables uRPF in loose mode, allowing packets from source addresses that have a route out of *any* interface, including a default route. This permits legitimate inbound traffic from 172.16.1.0/24 (routed out via the default route on Fa0/0) while blocking spoofed 10.0.0.0/8 traffic (routed out Fa0/1). `ip cef` must be enabled for uRPF to function.

B(config)#ip cef (config)#interface fa0/0 (config)#ip verify unicast source reachable-via rx

`ip verify unicast source reachable-via rx` (strict mode) would block legitimate inbound traffic from 172.16.1.0/24 because the best return path for that network is out Fa0/0, the same interface it arrives on, which fails strict uRPF.

C(config)#no ip cef (config)#interface fa0/0 (config-if)#ip verify unicast source reachable-via rx

`no ip cef` disables Cisco Express Forwarding, which is a prerequisite for uRPF functionality; without it, uRPF will not operate correctly.

D(config)#interface fa0/0 (config-if)#ip verify unicast source reachable-via any

`ip verify unicast source reachable-via any` is not a valid or standard uRPF command syntax for configuring loose mode.

Concept tested: Unicast Reverse Path Forwarding (uRPF) configuration

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_urpf/configuration/15-mt/sec-urpf-15-mt-book/sec-urpf-ovr.html

Topics

#uRPF#IP Spoofing Protection#CEF#Network Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-410 Practice