This read-write setting selects the URPF match mode for a specific interface and address family, choosing among none(1) (URPF not applied), strict(2) (the ingress interface must match the interface that would be used to route back to the source), or loose(3) (a route to the source must exist, but the ingress interface isn't checked), defaulting to none. Admins pick strict mode on symmetric-routed edge links where spoofing protection should be tightest, and loose mode where asymmetric routing makes strict checking impractical. An admin securing a single-homed customer-facing interface would set this to strict(2), while one on a multi-path core interface might use loose(3) instead.