Configure And Verify
5.2 Configure and verify infrastructure security features
2 min read
ENCOR 350-401 v1.2
Updated
Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.
On this page
What this section tests
Section 5.2 tests two configure and verify tools. Access Control Lists (ACLs) filter traffic. Control Plane Policing (CoPP) protects the device CPU. Both protect the network, but they protect different planes.
Articles
The three planes
| Plane | What it carries | Protection tool |
|---|---|---|
| Data plane | User and application traffic forwarded through the device | Interface ACLs |
| Control plane | Routing protocols, STP, ARP, ICMP to the device | CoPP |
| Management plane | SSH, SNMP, NETCONF, RESTCONF to the device | ACLs on lines, CoPP |
A router forwards packets in hardware. Traffic destined to the device itself goes to the CPU. An interface ACL cannot stop all of that traffic. CoPP rate-limits what reaches the CPU.
Transit packet:
enters interface -> interface ACL -> forwarded in hardware
Packet to the device:
enters interface -> punted to CPU -> CoPP polices the rateTopic map
| Topic | Control point | Proof command |
|---|---|---|
| Standard ACLs | Source address only, near the destination | show access-lists |
| Extended ACLs | Source, destination, protocol, ports, near the source | show access-lists |
| ACL direction | The interface, inbound or outbound | show ip interface |
| CoPP classes | Class maps matching CPU-bound traffic | show policy-map control-plane |
| CoPP rates | The police action per class | Class counters increase |
Study plan
- Read 5.2.a ACLs. Practice wildcard masks until they are fast.
- Apply an ACL in a lab. Prove it with match counters, not with the configuration text.
- Read 5.2.b CoPP. Build a small policy with routing, SSH, and ICMP classes.
- Learn to read
show policy-map control-planebefore you change any rate.
Exam traps
- A wildcard mask is inverted from a subnet mask. 0.0.0.255 matches a /24.
- Inbound and outbound are from the interface point of view.
- Every ACL ends with an implicit
deny any. - A
permitin a CoPP class-map ACL means match for classification. The policy action decides the result. - CoPP protects the CPU. It does not filter transit traffic.
Pass check
You are ready for Section 5.2 when you can do these things:
- Write an extended ACL for a concrete source, destination, and port from memory.
- Prove an ACL works by reading its match counters.
- Explain what traffic is punted to the CPU.
- Explain the difference between a class-map ACL and an interface ACL in CoPP.