Infrastructure Security · Topic 3 of 4
Control Plane Policing
Troubleshoot control plane policing on IOS XE: class maps, ACL matching rules, policing actions and how CoPP can block SSH, SNMP and routing protocols.
- 5 min
- CoPP protects the control plane using MQC.
- A service policy is applied under
control-planein the input direction. - In a CoPP ACL,
permitmeans match the class, not allow the packet.
What it is
Control plane policing limits the traffic that is allowed to reach a router's own CPU.
A router has three planes.
- The data plane forwards transit traffic.
- The control plane runs routing protocols and other protocols that talk to the router.
- The management plane handles access such as SSH and SNMP.
An attacker, or a bug, can flood the CPU with traffic addressed to the router. CoPP uses the Modular QoS CLI to rate limit or drop that traffic before it overloads the control plane.
How it works
CoPP uses class maps to find traffic, a policy map to act on it, and a service policy on the control plane.
The building blocks
| Item | Job |
|---|---|
| ACL | Identifies traffic by protocol, address and port |
| Class map | Groups traffic that matches an ACL |
| Policy map | Chooses an action for each class |
control-plane | Where the service policy is attached |
In a CoPP ACL, permit means a packet belongs to the class. It does not mean the packet is allowed. A deny line means the packet is not matched by that class and moves on to the next class.
Example policy
R1(config)# ip access-list extended COPP-MGMT
R1(config-ext-nacl)# permit tcp 10.0.0.0 0.0.0.255 any eq 22
R1(config-ext-nacl)# permit udp 10.0.0.0 0.0.0.255 any eq 161
R1(config)# ip access-list extended COPP-ROUTING
R1(config-ext-nacl)# permit ospf any any
R1(config-ext-nacl)# permit eigrp any any
R1(config-ext-nacl)# permit tcp any any eq bgp
R1(config-ext-nacl)# permit tcp any eq bgp any
R1(config)# class-map match-all CM-MGMT
R1(config-cmap)# match access-group name COPP-MGMT
R1(config)# class-map match-all CM-ROUTING
R1(config-cmap)# match access-group name COPP-ROUTING
R1(config)# policy-map COPP-POLICY
R1(config-pmap)# class CM-ROUTING
R1(config-pmap-c)# police 512000 conform-action transmit exceed-action transmit
R1(config-pmap)# class CM-MGMT
R1(config-pmap-c)# police 128000 conform-action transmit exceed-action drop
R1(config-pmap)# class class-default
R1(config-pmap-c)# police 64000 conform-action transmit exceed-action drop
R1(config)# control-plane
R1(config-cp)# service-policy input COPP-POLICYThe routing class is policed with an exceed action of transmit, so this class does not drop routing protocol packets. Management traffic is limited to a set rate. Everything else falls into class-default and is policed hard.
Traffic to include
The class maps must cover every protocol the router needs for its role.
| Traffic | What to match |
|---|---|
| Telnet | TCP port 23 |
| SSH | TCP port 22 |
| HTTP | TCP port 80 |
| HTTPS | TCP port 443 |
| SNMP | UDP port 161, and 162 for traps |
| EIGRP | Protocol EIGRP, multicast 224.0.0.10 |
| OSPF | Protocol OSPF, multicast 224.0.0.5 and 224.0.0.6 |
| BGP | TCP port 179 |
If a protocol is missing from the permitted classes, it lands in class-default, which in a policy like the example is policed hard. That is how CoPP causes OSPF or BGP neighbours to flap, or SSH sessions to freeze, after a policy is applied.
Verifying and troubleshooting
R1# show policy-map control-plane
R1# show access-lists COPP-ROUTING
R1# show control-plane host open-portsshow control-plane host open-ports lists the ports on which the router is listening. show policy-map control-plane lists each class with packet counts, and the conformed and exceeded counters. A large exceeded count on a routing class, or on class-default while routing flaps, points to CoPP.
Work through these steps when a protocol misbehaves after a CoPP change.
- Which class does the traffic fall into?
- Do the exceeded counters rise on that class?
- Is the ACL permit line correct for the protocol and direction?
- Is the policing rate high enough for normal peaks?
- Is the source address of a management host in the ACL?
Because ACL lines use permit to select traffic, a mistyped address leaves the traffic in a lower class. Check the ACL counters with show access-lists.
Some platforms ship with a default CoPP policy. Check the platform documentation before adding your own.
Test a new CoPP policy in a lab or with exceed actions set to transmit first, and watch the counters before you start dropping.
What to remember for the exam
Seven facts cover most questions on this topic.
- CoPP protects the control plane using MQC.
- A service policy is applied under
control-planein the input direction. - In a CoPP ACL,
permitmeans match the class, not allow the packet. - Unmatched traffic falls into
class-default. - Routing protocols, SSH and SNMP must be in the right classes.
show policy-map control-planeshows conformed and exceeded counters.- CoPP does not police transit traffic.
A policy that polices class-default too hard can drop routing hellos and lock you out of SSH.
Common mistakes
These four mistakes appear often.
Reading permit as allow. The line only selects the traffic for the class.
Forgetting a protocol. OSPF, EIGRP or BGP then lands in class-default.
Policing routing traffic with a drop action. Neighbours flap during bursts.
Writing the ACL for the wrong address. The management host never matches the class.
Check yourself
Work through these three questions.
Where is a CoPP service policy attached?
Under the
control-planeconfiguration mode, withservice-policy inputand the policy name.What does a permit line in a CoPP ACL do?
It selects the packet for that class, and does not by itself allow or block it.
Which command shows whether a class is exceeding its rate?
show policy-map control-planeshows the conformed and exceeded counters for each class.
Topic 3 of 4 in Infrastructure Security
Test yourself on Infrastructure Security
The full Cisco CCNP 300-410 ENARSI question bank has 857 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.