> For the complete documentation index, see [llms.txt](https://jncia-workbook.gitbook.io/workbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jncia-workbook.gitbook.io/workbook/junos-firewall-filters/8-anti-spoofing.md).
# 8) Anti-Spoofing
### Pre-Work
Load the config called **anti.spoofing.cfg** using the **load\_config\_on\_nodes.py** script.
```
python3 load_config_on_nodes.py --lab_dir three-routers --config_filename anti.spoofing.cfg
```
### Lab
OSPFv2 is already setup, but R3 is "misconfigured" with `1.1.1.1/32` on `Lo0.0`. This is R1's loopback address. Configure anti-spoofing on R2 `ge-0/0/1` so that traffic sourced from `1.1.1.1` on R3 is automatically dropped on R2.
### Answer
Expand to reveal
```
set interfaces ge-0/0/1.0 family inet rpf-check
```
### Explanation
Expand to reveal
uRPF is a common tool used for anti-spoofing. uRPF (unicast reverse path forwarding) is a technique for loop prevention that is used in multicast. It ensures that multicast traffic does not loop by only accepting incoming multicast traffic on one single interface. The source address of the multicast traffic is used to perform a unicast route lookup. The interface used for the best outgoing path to the source address is the uRPF interface - the interface the multicast traffic will be accepted on.
\
uRPF can also be used to implement anti-spoofing. We should only receive traffic *from* a given source address on the interface we use to route *to* that address. (Assuming there are no backup paths or asymmetrical paths). If we receive the packet on a different interface, we should drop it and assume the source address is being spoofed.
\
The default uRPF mode on Junos is **strict** mode. This means that the route used to reach the source address of an incoming packet must point out the same interface the packet was received on. In order words, if we receive 10.10.10.10 on ge-0/0/0.0, and the route to 10.10.10.10 uses `10.10.10.0/24 via ge-0/0/0.0`, the packet passes the uRPF strict mode check.
```
set interfaces ge-0/0/1.0 family inet rpf-check
```
\
Another option is **loose** mode, which means that the source address must simply match any route in the routing table. The outgoing interface of the route does not need to match the interface the packet was received on. This allows for situations in which you have asymmetric routing. On most (but not all) Juniper platforms, the default route is a valid match for uRPF loose mode. Therefore, if you have a default route, loose mode isn't really going to drop anything. However, you might use loose mode in combination with `set forwarding-options rpf-loose-mode-discard family inet` to drop traffic that points to a discard route. This is commonly used in RTBH configurations.
```
set interfaces ge-0/0/1.0 family inet rpf-check mode loose
```
\
Junos also offers uRPF **feasible** mode. This is an "in-between" of **strict** mode and **loose** mode, which some other vendors like Cisco do not offer. In feasible mode, the outgoing interfaces for all possible paths to the source are acceptable. This is a better way to handle asymmetric routing, but requires that the router has full path visibility of all possible paths (typically via BGP). Feasible mode is configured globally, not on each interface. You would use this in addition to configuring strict mode on individual interfaces.
```
set routing-options forwarding-table unicast-reverse-path feasible-paths
```
\
If we ping from R3 sourced with 1.1.1.1, we should see that these packets are dropped on R2 ge-0/0/1 due to RPF failure:
```
admin@R3> ping 2.2.2.2 source 1.1.1.1 count 3
PING 2.2.2.2 (2.2.2.2): 56 data bytes
--- 2.2.2.2 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss
```
We can view the number of packets and bytes dropped due to RPF failure using `show interfaces detail`:
```
admin@R2> show interfaces ge-0/0/1 detail | match RPF
Flags: Sendbcast-pkt-to-re, uRPF, 0x0
RPF Failures: Packets: 3, Bytes: 252
```
### Further Reading