A service provider connects a single-homed customer edge (CE) router to a provider edge (PE) router on a dedicated interface. The security team wants to implement data plane protection that drops packets whose source address is not reachable via the exact interface on which they arrive, mitigating source-address spoofing from that customer. Which feature and mode should be configured on the PE interface?