使用 URPF 来阻止IP地址欺骗（ IP Address Spoofing）

【实验说明】
上一个实验是《使用ACL 来预防IP地址欺骗》，但是配置起来相对复杂，本实验我们将使用URPF（Unicast Reverse Path Forwarding）来轻松实现预防部分IP地址欺骗，URPF的知识请查看《Unicast RPF，单播逆向转发》 文章

 

【实验拓扑】

I OS：c2691-advsecurityk9-mz.124-11.T2.bin

 

【实验配置步骤】

• 配置上图网络为 IP service 中的“Common Configuration”
• 本实验将启用uRPF检查，但配置特定网络免受检查
• 所有的尝试欺骗都记录日志
• 在R5上创建Loopback1接口，IP地址为150.1.55.55/24，创建loopback2接口，IP地址为150.1.155.155/24
• 不通告上面两个loopback地址到路由协议
• 禁止R4上的BGP，以阻止其接收默认路由
• 在R4上创建 access-list 100 允许150.1.55.0/24网络. 拒绝其他并记录日志
• 在R4上外网口（串口）配置uRPF ,使access-list 100 作为uRPF ACL

 

【实验配置】

R5：

interface Loopback1

ip address 150.1.55.55 255.255.255.0

interface Loopback2

ip address 150.1.155.155 255.255.255.0

R4:

no router bgp 1

access-list 100 permit ip 150.1.55.0 0.0.0.255 any

access-list 100 deny ip any any log

!

int s0/1

ip verify unicast reverse-path 100

!

int s0/0.1

ip verify unicast reverse-path 100

 

【 Common Configuration 配置】

R1: interface FastEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip route 0.0.0.0 0.0.0.0 10.0.0.4   R6: interface FastEthernet0/0 ip address 10.0.0.6 255.255.255.0 ip route 0.0.0.0 0.0.0.0 10.0.0.4 R4： interface Loopback0 ip address 150.1.4.4 255.255.255.0 ip ospf network point-to-point ! interface FastEthernet0/0 ip address 10.0.0.4 255.255.255.0 ! interface Serial0/0 en fram no sh ! interface Serial0/0.1 point-to-point ip address 155.1.0.4 255.255.255.0 frame-relay interface-dlci 405 ! interface Serial0/1 ip address 155.1.45.4 255.255.255.0 clock rate 2000000 ! router ospf 1 router-id 150.1.4.4 network 150.1.4.4 0.0.0.0 area 0 network 155.1.0.4 0.0.0.0 area 0 network 155.1.45.4 0.0.0.0 area 0 ! router bgp 1 bgp router-id 150.1.4.4 neighbor 150.1.5.5 remote-as 2 neighbor 150.1.5.5 ebgp-multihop 255 neighbor 150.1.5.5 update-source Loopback0

R5: interface Loopback0 ip address 150.1.5.5 255.255.255.0 ip ospf network point-to-point ! interface Serial0/0 encapsulation frame-relay ! interface Serial0/0.1 point-to-point ip address 155.1.0.5 255.255.255.0 frame-relay interface-dlci 504 ! interface Serial0/1 ip address 155.1.45.5 255.255.255.0 clock rate 2000000 ! router ospf 1 router-id 150.1.5.5 network 150.1.5.5 0.0.0.0 area 0 network 155.1.0.5 0.0.0.0 area 0 network 155.1.45.5 0.0.0.0 area 0 ! router bgp 2 bgp router-id 150.1.5.5 neighbor 150.1.4.4 remote-as 1 neighbor 150.1.4.4 ebgp-multihop 255 neighbor 150.1.4.4 update-source Loopback0 neighbor 150.1.4.4 default-originate

【实验验证】

R5#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

 

Gateway of last resort is not set

 

155.1.0.0/24 is subnetted, 2 subnets

C 155.1.0.0 is directly connected, Serial0/0.1

C 155.1.45.0 is directly connected, Serial0/1

150.1.0.0/24 is subnetted, 4 subnets

C 150.1.155.0 is directly connected, Loopback2

C 150.1.5.0 is directly connected, Loopback0

O 150.1.4.0 [110/65] via 155.1.45.4, 00:18:39, Serial0/1

[110/65] via 155.1.0.4, 00:18:39, Serial0/0.1

C 150.1.55.0 is directly connected, Loopback1

 

R5#ping 150.1.4.4

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 150.1.4.4, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/22/52 ms

R5#ping 150.1.4.4 source loopback1

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 150.1.4.4, timeout is 2 seconds:

Packet sent with a source address of 150.1.55.55

.....

R4#show ip access-list

*Mar 1 00:17:57.727: %SYS-5-CONFIG_I: Configured from console by console

R4#show ip access

R4#show ip access-lists

Extended IP access list 100

10 permit ip 150.1.55.0 0.0.0.255 any (5 matches)

20 deny ip any any log

 

R4#show ip int s0/0.1

Serial0/0.1 is up, line protocol is up

Internet address is 155.1.0.4/24

Broadcast address is 255.255.255.255

Address determined by non-volatile memory

MTU is 1500 bytes

Helper address is not set

Directed broadcast forwarding is disabled

Multicast reserved groups joined: 224.0.0.5

Outgoing access list is not set

Inbound access list is not set

Proxy ARP is enabled

Local Proxy ARP is disabled

Security level is default

Split horizon is enabled

ICMP redirects are always sent

ICMP unreachables are always sent

ICMP mask replies are never sent

IP fast switching is enabled

IP fast switching on the same interface is enabled

IP Flow switching is disabled

IP CEF switching is enabled

IP CEF Feature Fast switching turbo vector

IP multicast fast switching is enabled

IP multicast distributed fast switching is disabled

IP route-cache flags are Fast, CEF

Router Discovery is disabled

IP output packet accounting is disabled

IP access violation accounting is disabled

TCP/IP header compression is disabled

RTP/IP header compression is disabled

Policy routing is disabled

Network address translation is disabled

BGP Policy Mapping is disabled

WCCP Redirect outbound is disabled

WCCP Redirect inbound is disabled

WCCP Redirect exclude is disabled

IP verify source reachable-via RX, allow default, ACL 100

0 verification drops

5 suppressed verification drops

 

R5#ping 150.1.4.4 source l2

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 150.1.4.4, timeout is 2 seconds:

Packet sent with a source address of 150.1.155.155

.....

R4#show ip access 100

Extended IP access list 100

10 permit ip 150.1.55.0 0.0.0.255 any (5 matches)

20 deny ip any any log (5 matches)

 

R4#

*Mar 1 00:24:14.719: %SEC-6-IPACCESSLOGDP: list 100 denied icmp 150.1.155.155 -> 150.1.4.4 (0/0), 4 packets

 

R4#show ip int s0/0.1

Serial0/0.1 is up, line protocol is up

Internet address is 155.1.0.4/24

Broadcast address is 255.255.255.255

Address determined by non-volatile memory

MTU is 1500 bytes

Helper address is not set

Directed broadcast forwarding is disabled

Multicast reserved groups joined: 224.0.0.5

Outgoing access list is not set

Inbound access list is not set

Proxy ARP is enabled

Local Proxy ARP is disabled

Security level is default

Split horizon is enabled

ICMP redirects are always sent

ICMP unreachables are always sent

ICMP mask replies are never sent

IP fast switching is enabled

IP fast switching on the same interface is enabled

IP Flow switching is disabled

IP CEF switching is enabled

IP CEF Feature Fast switching turbo vector

IP multicast fast switching is enabled

IP multicast distributed fast switching is disabled

IP route-cache flags are Fast, CEF

Router Discovery is disabled

IP output packet accounting is disabled

IP access violation accounting is disabled

TCP/IP header compression is disabled

RTP/IP header compression is disabled

Policy routing is disabled

Network address translation is disabled

BGP Policy Mapping is disabled

WCCP Redirect outbound is disabled

WCCP Redirect inbound is disabled

WCCP Redirect exclude is disabled

IP verify source reachable-via RX, allow default, ACL 100

5 verification drops

5 suppressed verification drops