Unicast RPF works in one of below modes:
1. Strict mode: Router will perform two checks:.
A. Router checks the routing entry for the source address of the packet and will drop the packet in case no route is present on the routing table for the source address.
B. Router will ensure that the source of incoming packet is reachable via same interface. Router will drop the packet in case source address is learned via different interface than from the one, packet in ingress ed.
Command:-
Int eth1/1
ip verify unicast reverse-path –<<< Old command but still available on some platforms
or
IP verify unicast source reachable-via rx
ip verify unicast reverse-path (Unicast RPF)
2. Loose mode(default mode): Only make sure that route for the source address is present in the routing table.
Int eth1/1
IP verify unicast source reachable-via Any
Note:- Above matching criteria is not applicable for default route and will not allow traffic where source is only matching the default route. the ” Allow-default” keyword is used to change this behaviour and traffic will be allowed where source address is matching only the default route.