Security · Topic 4 of 7

Control Plane Policing

Understand and configure Control Plane Policing on IOS XE to protect the CPU: the three planes, MQC classes, police actions and verification.

  • 6 min
In a nutshell
  • CoPP protects the CPU from excess control plane and management traffic.
  • The control plane builds forwarding tables. The management plane is how admins reach the device.
  • CoPP uses MQC: a class map, a policy map and a service policy.

What it is

Control Plane Policing (CoPP) limits the traffic that is allowed to reach the CPU of a router or switch.

A network device forwards most traffic in hardware, but some packets must be handled by the CPU. If too many of them arrive, the CPU is overloaded, and routing protocols and management sessions fail.

This can happen by accident, or because an attacker floods the device on purpose. CoPP puts a rate limit in front of the CPU.

Traffic to the routerdata and control packetssome punted toCPU pathcontrol plane interfaceCoPP policyRouting and managementprotected processes

How it works

CoPP applies a quality of service policy to a special interface that represents the control plane.

The three planes

PlaneJobExamples
Data planeForwards user traffic through the devicePackets passing through
Control planeBuilds the tables that forwarding usesOSPF, BGP, ARP, spanning tree
Management planeLets administrators reach the deviceSSH, SNMP, NTP, syslog

CoPP protects the control plane and the management plane, because their packets are addressed to the device itself, or need CPU work. Normal transit traffic that is switched in hardware does not reach the CPU, so CoPP does not affect it.

How CoPP is built

CoPP uses the same Modular QoS CLI as other QoS features. You write a class map to find the traffic, a policy map to say how much is allowed, and you apply the policy to the control-plane interface. This IOS XE router example shows the idea, and other platforms differ.

R1(config)# ip access-list extended COPP-ICMP
R1(config-ext-nacl)# permit icmp any any
R1(config)# ip access-list extended COPP-MGMT
R1(config-ext-nacl)# permit tcp 10.99.0.0 0.0.0.255 any eq 22
R1(config)# class-map match-all CM-ICMP
R1(config-cmap)# match access-group name COPP-ICMP
R1(config)# class-map match-all CM-MGMT
R1(config-cmap)# match access-group name COPP-MGMT
R1(config)# policy-map COPP-POLICY
R1(config-pmap)# class CM-MGMT
R1(config-pmap-c)# police 256000 conform-action transmit exceed-action transmit
R1(config-pmap)# class CM-ICMP
R1(config-pmap-c)# police 32000 conform-action transmit exceed-action drop
R1(config)# control-plane
R1(config-cp)# service-policy input COPP-POLICY

The management class is allowed to exceed its rate here, because losing management access in an attack would be worse. Any traffic that matches neither class falls into class-default, which is unrestricted unless you police it.

Classifying traffic

A class can match on:

  • An access list, as in the example.
  • DSCP or IP precedence values.
  • Protocol names, where the platform supports them.

Typical classes are routing protocols, management, ICMP, and everything else. Put the most important traffic in its own class and give it a generous rate.

Police actions

ActionEffect
transmitAllow the packet
dropDiscard the packet
set-dscp-transmitRe-mark and allow the packet

A conform-action applies to packets within the rate, and an exceed-action applies to packets above it. The usual protective setup is to transmit conforming packets and drop the excess.

Direction

A policy applies to the control-plane interface in the input direction. That covers packets that arrive for the CPU. Some platforms also accept an output policy for packets that the CPU sends, but input is the common one.

Platform differences

Behaviour varies between platforms. On Catalyst 9000 switches running IOS XE, a default system policy named system-cpp-policy is applied to the control plane out of the box. The classes in it protect typical traffic types by hardware policers, and on these switches you normally tune the rates in that default policy rather than apply a new policy of your own.

Switch# show policy-map control-plane
Switch# show policy-map system-cpp-policy

On IOS XE routers, there is usually no policy until you create one. Before you build your own, check what the platform provides, so you do not remove a useful default.

Verifying

R1# show policy-map control-plane
R1# show access-lists COPP-ICMP
R1# show running-config | section control-plane

show policy-map control-plane shows each class with its match counters and the number of packets that conformed and exceeded. A growing exceed count on one class shows that it is hitting its limit. Use these counters to tune the rates, because a rate set too low drops useful traffic.

Building a policy safely

  1. Start in monitor mode. Use transmit for both actions, so you only count traffic.
  2. Read the counters over a normal working period.
  3. Set rates above the normal peak, with some room.
  4. Change the exceed action to drop for classes that should be limited.
  5. Keep a class for management traffic with a generous rate.
Learntransmit and countstudy the countersTuneset rates above peakchange exceed actionEnforcedrop the excess

What to remember for the exam

Seven facts cover most questions on this topic.

  • CoPP protects the CPU from excess control plane and management traffic.
  • The control plane builds forwarding tables. The management plane is how admins reach the device.
  • CoPP uses MQC: a class map, a policy map and a service policy.
  • The policy is applied to the control-plane interface, usually in the input direction.
  • police with conform-action and exceed-action sets the rate and the response.
  • Transit traffic switched in hardware is not affected by CoPP.
  • show policy-map control-plane shows the counters.
Exam tip

Protect management and routing protocol traffic with its own class, so an attack on one kind of traffic does not block them.

Common mistakes

These four mistakes appear often.

Setting rates by guessing. A rate that is too low drops useful traffic, so measure first.

Forgetting routing protocols. If they are policed too hard, neighbours drop.

Thinking CoPP filters user traffic. It only acts on traffic that goes to the CPU.

Applying the policy to a normal interface. CoPP is applied on the control-plane interface.

Watch out

A wrong CoPP policy can cut off your own management access, so test it with a console connection and start with transmit actions.

Check yourself

Work through these three questions.

  • On which interface is a CoPP policy applied?

    On the control-plane interface, usually with service-policy input.

  • Does CoPP limit user traffic that passes through the router in hardware?

    No, it acts only on traffic that goes to the CPU.

  • Why start a CoPP policy with the transmit action?

    The counters show real traffic levels, so you can set safe rates before you start to drop.

Topic 4 of 7 in Security

Test yourself on Security

The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.