CCNP ENARSI Lab: Troubleshooting uRPF | Expert Guide by Saeed Ahmad

Master Advanced Security Troubleshooting: A definitive guide to diagnosing and fixing Unicast Reverse Path Forwarding (uRPF) issues in Cisco IOS XE. Essential for CCNP ENARSI (300-410) candidates. Curated by Mr. Saeed Ahmad, Cisco NetAcad Recommended Expert Instructor since 2008.

---

Lab Overview: The uRPF Challenge

In modern enterprise networks, preventing IP spoofing is critical. Unicast Reverse Path Forwarding (uRPF) verifies if the source IP of an incoming packet is reachable via the interface it arrived on. However, misconfiguring uRPF—especially in asymmetric routing environments—can inadvertently block legitimate traffic.

This lab simulates a real-world trouble ticket where security hardening on Router R1 caused connectivity loss between 172.16.10.0/24 and 172.16.20.0/24. Your mission: Identify the uRPF misconfiguration, restore connectivity, and validate security.

Topology & Addressing Table

Device	Interface	IP Address	Subnet Mask
R1	G0/0/0	10.20.1.1	255.255.255.0
R1	S0/1/0	10.20.3.2	255.255.255.0
R1	Lo1	172.16.10.10	255.255.255.0
R2	G0/0/0	10.20.1.2	255.255.255.0
R2	G0/0/1	10.20.2.1	255.255.255.0
R3	G0/0/0	10.20.2.2	255.255.255.0
R3	S0/1/0	10.20.3.1	255.255.255.0
R3	Lo1	172.16.20.20	255.255.255.0

Part 1: Loading the Trouble Ticket

Configurations are pre-loaded with intentional errors. Initialize the lab on your Cisco 8200L routers (IOS XE 17.12.05c) using these commands:

// On R1
copy flash:/enarsi/32.1.3.1-r1-config.txt running-config

// On R2
copy flash:/enarsi/32.1.3.1-r2-config.txt running-config

// On R3
copy flash:/enarsi/32.1.3.1-r3-config.txt running-config

// Password: cisco12345

Part 2: Troubleshooting Methodology

Step 1: Validate the Issue

The ticket states that 172.16.20.0/24 (R3 Loopback) cannot reach 172.16.10.0/24 (R1 Loopback). Start by pinging from R3 to R1’s loopback.

R3# ping 172.16.10.10 source loopback 1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.10.10, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Step 2: Check Routing & uRPF Status

Since EIGRP is used, verify routes exist. If routes are present, check for uRPF drops using interface counters.

R1# show ip route 172.16.20.0
// Verify route exists via S0/1/0 or G0/0/0

R1# show interfaces g0/0/0 | include drop
// Look for "input packets dropped due to RPF check"

Step 3: Identify the Misconfiguration

Common uRPF issues in this topology include:

• Strict Mode on Multi-Homed Interfaces: If R1 receives traffic from R3 on an interface where the return path is different (asymmetric routing), strict uRPF will drop it.
• Missing Default Route: uRPF checks the FIB. If the return path isn’t in the routing table, the packet fails the check.
• Incorrect Interface Application: uRPF applied on the wrong interface (e.g., inside vs. outside).

Step 4: Fix & Verify

Once identified, correct the configuration. For example, if strict mode is causing drops due to asymmetric routing, switch to loose mode or ensure symmetric paths.

R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# no ip verify unicast source reachable-via rx
R1(config-if)# ip verify unicast source reachable-via any allow-default
// Or adjust routing to ensure symmetry

Part 3: Completing the Ticket

After restoring connectivity, follow these final steps to close the ticket:

1. Update MOTD: banner motd # This is $(hostname) FIXED from ticket 32.1.3.1 #
2. Verify uRPF: Ensure show ip interface confirms uRPF is active.
3. Test Connectivity: Ping all loopbacks and physical interfaces.
4. Save Config: wri or copy running-config startup-config.
5. Reset: After instructor approval, issue reset.now on all devices.

---

Expert Tips for uRPF Troubleshooting

To excel in the CCNP ENARSI exam and real-world scenarios:

• Check the FIB: Use show ip cef to verify the return path exists.
• Understand Topology: Draw the data flow. Is it symmetric? If not, strict uRPF will fail.
• Use Allow-Default: In stub networks, allow-default can prevent drops due to missing specific routes.
• Document Changes: Always update banners and save configs after troubleshooting.

---

---

🔑 Key Takeaways for ENARSI

• Strict vs. Loose Mode: Know when to use each.
• FIB Dependency: uRPF relies on the Forwarding Information Base.
• Asymmetric Routing: The #1 cause of uRPF failures.
• Verification: Always check interface counters for drops.
• Security Balance: Maintain security without breaking connectivity.

Disclaimer: This lab guide is based on Cisco IOS XE Release 17.12.05c. Commands and outputs may vary slightly depending on the router model and IOS version. Always refer to official Cisco documentation for the most current specifications. Not affiliated with Cisco Systems, Inc. Trademarks belong to their respective owners.