Source Address Validation

ACL(Access Control List)

• Packet filtering
• Application of a list of source IP address that are allowed to flow into a network.

uRPF (Unicast Reverse Path Forwarding) Check

• Use router path information
• Confirm whether the incoming source IP address is from the original path

A uRPF check utilizes router path information to confirm the source address. As long as the path information remains correct, there is no particular need for management. More specifically, just as the destination address is used to search for a path address, and then on to the next forwarding destination, path information can be searched using the source address, comparing the interface of the forwarding destination and the interface of the incoming packet to perform a validity check.

The uRPF check method consists of several modes:

Mutual Connections between IIJ and other ISPs

Incorporates technology equivalent to uRPF loose mode.

Services for Business Customers

Personal Services

Effect of Implementation on Communication

Under uRPF strict mode and ACL packet filtering, communication with a source address that is the same as the IP address space for using the access service that has been assigned by IIJ (or the IP address already owned by the customer and reported to IIJ to be used) are treated as normal communication. Alternately, packets with a different source than the source address used to link to the access service are rejected.

In general, strict mode has no effect on communication when only one Internet access service is used.

However, under certain conditions where a multiple number of Internet access services are used in a specific manner, strict mode can negatively affect communication.

For example, an organization uses two Internet connection lines, each having its own assigned IP address:

• Address assigned by Access Service A: 198.51.100.0/24, 2001:DB8:AAAA::/48
• Address assigned by Access Service B: 203.0.113.0/24,　2001:DB8:BBBB::/48

Strict source address verify for Access Service B

When communicating using the Access Service B line, a problem will occur if the address assigned by Access Service A is used as the source address.

Using the Access Service B, only packets using source address 203.0.113.0/24, 2001:DB8:BBBB::/48 linked to the access service will be allowed to pass through, while any packets using a different source address will be rejected. Accordingly, any packets with the source address assigned through Access Service A will be rejected when coming from the Access Service A line.

Even under this structure, there will be no effect on communication as long as the access service and assigned address correspond properly.

In cases where the network structure may cause a discrepancy in access service and source address, we ask that customers revise their network so that address match, and that each connection service uses the correct address.

With ISP-to-ISP connections, or where networks have a redundant structure using multiple access lines, the upstream and downstream communication paths may be in an asymmetric state. According to uRPF strict mode, the path to the source address and the interface from which the packet comes do not match; consequently, even packets having a correct source address can be rejected. In other words, uRPF strict mode cannot be implemented under certain connection topologies.

In the preceding situation, uRPF loose mode can be used as the technology for confirming source address. Under uRPF loose mode, packets that have a source address that exists within the path information are allowed to pass through, and any other packets are rejected. This means that, for example, packets using private address and unused address (generally viewed as improper source address), as well as packets using multicast address or other special address are detected and rejected. However, the drawback here is that if the source address exists within the path information, even if that source address has been spoofed, the packet will be allowed through.

uRPF loose mode has no effect on customer communication, since only packets with a clearly improper source address are rejected. Prior to implementation, even packets containing a source address not located within the path information will arrive at the destination; however, the response from the destination will not be able to reach the source, preventing communication. In a post-implementation environment, packets with source address determined as improper are rejected before they can reach the destination. There is no change here in the sense that communication do not occur, but the benefit of implementation is a reduced level of unneeded packets moving within the network.

Enable Source Address Validation on your Network

The closer to the packet source, the more effective Source Address Validation is. When Source Address Validation is close to the source, unneeded communications can be rejected at a much quicker stage in the process, reducing the effect on an internal network. In addition, the closer to the source, the more detail with which a source address can be checked. This characteristic means that implementation of Source Address Validation not only on the part of the ISP, but also on the part of the customer's internal network results in much more effective source checking.

IIJs' "SEIL" routers (SEIL/X1,SEIL/X2,SEIL/B1,SEIL/X86 Fuji, SEIL/Plus, SEIL/Turbo)  have the uRPF function. The SEIL provides Source Address Validation function to our customers. Our Customers are able to easily use the Source Addess Validation on their networks.

Since Source Address Validation does not have any effect on normal communication, customers may find it difficult to actually feel whether it is effective. But be assured that Source Address Validation will prevent damage to your networks that can be caused by worms or DoS attacks using spoofed source IP address. Both RFC2827 (BCP38) and RFC3704 (BCP84) recommend that all network administrators cooperate to help prevent source address spoofing.

In theory, if Source Address Validation were implemented not only on the IIJ network, but on all networks worldwide, we could eradicate from the Internet any attacks relying on source address spoofing.

At IIJ, we have actively engaged in Source Address Validation measures and education to reduce the effects of improper communication, providing an environment whereby our customers can use the Internet with greater safety and confidence.