You are designing dual-homed active/active ISP connections from an enterprise customer for internet services, and you have recommended BGP between the customer and ISP. When three security…

uRPF in strict mode drops packets whose source address does not match the specific interface on which they arrive, which would cause legitimate traffic drops in an active/active dual-homed design due to asymmetric routing.

Remote triggered black holes (RTBH) allow the enterprise or ISP to null-route attack source prefixes by advertising a /32 host route tagged with a blackhole community to upstream peers, enabling rapid traffic scrubbing at the ISP edge.

IDS is a passive detection technology and is not a BGP session security or routing security mechanism applied directly to the ISP peering connection.

GTSM (Generalized TTL Security Mechanism) sets a minimum TTL on BGP packets to protect against off-link spoofing but is less applicable to standard multi-hop ISP peering and was not selected alongside the three core mechanisms.

Routing protocol authentication (MD5 or TCP-AO on BGP sessions) prevents unauthorized peers from forming sessions and protects against route injection or BGP session reset attacks.

uRPF in loose mode verifies only that a source IP address exists anywhere in the routing table rather than on the arriving interface, making it safe for active/active dual-homed topologies where asymmetric routing is inherent.