A school district WAN edge should drop inbound packets whose source addresses are not reachable via the receiving interface's FIB path under symmetric routing. Which uRPF mode enforces that check?
Select an answer to reveal the explanation.
Short Explanation
Strict uRPF is the "did you come in the door that actually leads back to your house?" check. If the return path isn't that same interface, the packet is treated as a fake.
Full Explanation
A school district WAN edge that should drop inbound packets whose source addresses are not reachable via the receiving interface's FIB path under symmetric routing needs strict uRPF. Strict mode requires the source to be reachable via the same interface that received the packet, which enforces a tight reverse-path check aligned with symmetric forwarding. The correct mode works because spoofed sources that would not be routed back out that interface fail the RPF check and are dropped before they enter the civic network. Claiming loose uRPF only, which ignores the FIB entirely and compares MAC OUIs, fails because loose mode still uses the FIB (any interface) and does not match MAC OUIs; it is also the weaker check relative to the stem's same-interface requirement. Disabling uRPF and replacing it with TTL propagation fails conceptually: TTL propagation is unrelated to unicast reverse-path validation. Renaming strict mode as CoPP class-default fails because CoPP polices control-plane traffic destined to the router CPU; it is not a substitute name or mechanism for interface uRPF spoof drops. Exam caveat: strict uRPF assumes symmetry; asymmetric civic or ISP designs will drop legitimate traffic if strict mode is forced. Operational check: enable strict uRPF on the symmetric edge interface, verify with show ip interface that RPF is active, test legitimate and spoofed sources, and monitor drop counters before promoting the change district-wide.