5.2.b CoPP

What this objective tests

The exam wants you to configure and verify Control Plane Policing (CoPP). You must classify traffic that goes to the device CPU, apply police rates per class, and read the per-class counters. This matters because hardware forwards transit traffic, but the CPU processes control and management traffic. A flood of CPU-bound traffic can kill routing and management while forwarding still works.

What reaches the CPU

• Routing protocol packets: OSPF, EIGRP, BGP.
• Spanning tree and other Layer 2 control protocols.
• ARP and ICMP destined to the device.
• Management traffic: SSH, SNMP, NETCONF, RESTCONF.
• Exception traffic: TTL expired, fragmentation needed.

Transit packet      -> forwarded in hardware
Packet to device    -> punted to CPU -> CoPP polices it
Exception packet    -> punted to CPU -> CoPP polices it

Note: CoPP is the last line of defense for the device. It does not replace interface ACLs or firewall policy.

The four building blocks

1. ACLs name the traffic.
2. Class maps group the ACLs into classes.
3. A policy map sets a police rate per class.
4. The control plane applies the policy in the input direction.

A permit in a CoPP classification ACL means match this class. It does not mean forward. The policy action decides what happens to matched traffic.

Example: three-class policy on R1

Scenario: R1 runs OSPF. The management subnet is 10.10.10.0/24. Build three classes: routing protocols, management SSH, and diagnostic ICMP. Give routing the highest rate. Give ICMP a small rate.

ip access-list extended COPP-ROUTING
 remark OSPF and BGP to the control plane
 permit ospf any any
 permit tcp any any eq bgp
 permit tcp any eq bgp any

ip access-list extended COPP-MGMT
 remark SSH from the management subnet only
 permit tcp 10.10.10.0 0.0.0.255 any eq 22

ip access-list extended COPP-ICMP
 remark Ping and traceroute support
 permit icmp any any echo
 permit icmp any any echo-reply
 permit icmp any any time-exceeded
 permit icmp any any unreachable

class-map match-any COPP-ROUTING
 match access-group name COPP-ROUTING

class-map match-any COPP-MGMT
 match access-group name COPP-MGMT

class-map match-any COPP-ICMP
 match access-group name COPP-ICMP

policy-map COPP-POLICY
 class COPP-ROUTING
  police 128000 conform-action transmit exceed-action drop
 class COPP-MGMT
  police 64000 conform-action transmit exceed-action drop
 class COPP-ICMP
  police 32000 conform-action transmit exceed-action drop
 class class-default
  police 16000 conform-action transmit exceed-action drop

control-plane
 service-policy input COPP-POLICY

Read the rates as bits per second. Traffic at or under the rate is transmitted. Traffic over the rate is dropped. Anything that matches no class falls into class-default.

Warning: A police rate that is too low can break routing, management, and monitoring at the same time. Do not paste a policy into a production device. Observe the default policy and counters first. Tune one class at a time.

Expected verification output:

R1# show policy-map control-plane
 Control Plane

  Service-policy input: COPP-POLICY

    Class-map: COPP-ROUTING (match-any)
      1521 packets, 121680 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group name COPP-ROUTING
      police:
          rate 128000 bps, burst 4000 bytes
        conformed 1521 packets, 121680 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        conformed 0000 bps, exceeded 0000 bps

    Class-map: COPP-MGMT (match-any)
      86 packets, 6192 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group name COPP-MGMT
      police:
          rate 64000 bps, burst 2000 bytes
        conformed 86 packets, 6192 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop

    Class-map: COPP-ICMP (match-any)
      44 packets, 4400 bytes
      Match: access-group name COPP-ICMP

    Class-map: class-default (match-any)
      12 packets, 960 bytes
      Match: any

Read the counters before you change a rate. A failing protocol with drops in class-default has a classification problem. A failing protocol with exceeded drops in its own class has a rate problem. The fixes are different.

Lab: protect the CPU on R1

Topology:

[Admin PC 10.10.10.50] ---- [R1 10.10.10.2] ---- [R2, OSPF neighbor]

Do these steps:

1. Configure OSPF between R1 and R2. Confirm the adjacency is full.
2. Create the four ACLs and three class maps from the example.
3. Create policy map COPP-POLICY with the rates from the example.
4. Run show policy-map control-plane. Record the starting counters.
5. Apply the policy with control-plane and service-policy input COPP-POLICY.
6. Connect with SSH from 10.10.10.50.
7. Ping R1 from the admin PC.
8. Run show policy-map control-plane again.
9. Confirm OSPF packets increase in COPP-ROUTING, SSH in COPP-MGMT, and ping in COPP-ICMP.
10. Confirm the OSPF adjacency stayed full and SSH stayed responsive.

Expected results:

• Each test increases only its own class counter.
• The OSPF adjacency does not flap.
• Unexpected traffic falls into class-default at the lowest rate.

Exam traps

• CoPP protects the control plane. Transit traffic does not hit it.
• A class-map ACL is for classification. It is not an interface security ACL.
• class-default catches everything else. Watch it for unexpected drops.
• Most platforms ship a default control-plane policy. Check it before you replace it.
• CoPP ACLs match traffic destined to the device. A transit-style ACL misses that traffic.

Pass check

You are ready for this objective when you can do these things:

• Name five kinds of traffic that are punted to the CPU.
• Write the four CoPP building blocks in order: ACL, class map, policy map, control plane.
• Explain what police 64000 conform-action transmit exceed-action drop does.
• Read show policy-map control-plane and find conformed and exceeded counters.
• Explain why a low rate on a routing class can break the network.