Table Of Contents
Control Plane Protection
Contents
Prerequisites for Control Plane Protection
Restrictions for Control Plane Protection
Information About Control Plane Protection
Benefits of Control Plane Protection
Control Plane Protection Architecture
Control-plane Interface and Subinterfaces
Port-filtering
Queue-thresholding
Aggregate Control-plane Services
How to Configure Control Plane Protection
Defining Packet Classification Criteria for CoPP
Prerequisites
Restrictions
Defining a CoPP Service Policy
Restrictions
Entering Control Plane Configuration Mode
Restrictions
Applying CoPP Service Policy
Prerequisites
Restrictions
Configuring Port-filter Policy
Restrictions
Defining Port-filter Packet Classification Criteria
Restrictions
Defining Port-filter Service Policy
Restrictions
Applying Port-filter Service Policy to the Host Subinterface
Prerequisites
Restrictions
Examples
Configuring Queue-threshold Policy
Restrictions
Defining Queue-threshold Packet Classification Criteria
Restrictions
Defining a Queue-threshold Service Policy
Restrictions
Applying a Queue-threshold policy to the Host Subinterface
Prerequisites
Restrictions
Examples
Verifying Control Plane Protection
Examples
Additional References
Related Documents
Standards
MIBs
RFCs
Technical Assistance
Command Reference
Control Plane Protection
The Control Plane Protection feature is an extension of the policing functionality provided by the existing Control-Plane Policing feature. The Control-Plane Policing feature allows Quality of Service (QoS) policing of aggregate control-plane traffic destined to the route processor. The Control Plane Protection feature extends this policing functionality by allowing finer policing granularity.
The functionality added with Control Plane Protection includes a traffic classifier, which intercepts traffic and classifies it into three control-plane categories. New port-filtering and queue-thresholding features have also been added. The port-filtering feature provides for policing of packets going to closed or nonlistened TCP/UDP ports, while queue-thresholding limits the number of packets for a specified protocol that will be allowed in the control-plane IP input queue.
History for the Control Plane Protection Feature
Release
|
Modification
|
12.4(4)T
|
This feature was introduced.
|
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•Prerequisites for Control Plane Protection
•Restrictions for Control Plane Protection
•Information About Control Plane Protection
•How to Configure Control Plane Protection
•Additional References
•Command Reference
Prerequisites for Control Plane Protection
•You understand the principles of Control-Plane Policing and how to classify control-plane traffic.
•You understand the concepts and general configuration procedure (class map and policy map) for applying QoS policies on a router.
For information about control plane policing and its capabilities, see the "Control Plane Policing" module.
For information about Cisco IOS QoS and the procedure for configuring QoS in your network using the Modular Quality of Service (QoS) Command-Line Interface (CLI) (MQC), see the "Applying QoS Features Using the MQC" module.
Restrictions for Control Plane Protection
Control Plane Protection for IPv4
Control Plane Protection is restricted to IPv4 input path only.
No Support for Direct ACL Configuration
The current release of Control Plane Protection does not support direct access control list (ACL) configuration in the control-plane subinterfaces, but rather can be configured using Modular QoS CLI (MQC) policies.
Requires CEF
Control Plane Protection depends on Cisco Express Forwarding (CEF) for IP packet redirection. If you disable CEF globally, this will remove all active protect and policing policies configured on the control-plane subinterfaces. Aggregate control-plane interface policies will continue to function as normal.
Control-plane Feature Policy Restriction
Policies applicable on the control-plane host subinterface are subject to the following restrictions:
•The port-filter feature policy supports only TCP/UDP-based protocols.
•The queue-thresholding feature policy supports only TCP/UDP-based protocols.
No Support for Distributed or Hardware Switching Platforms
This release does not provide support for distributed or hardware switching platforms.
Control-plane IP Traffic Classification Restrictions
The control-plane host subinterface only supports TCP/UDP-based host traffic. All IP packets entering the control-plane matching any of the following conditions are not classified any further and are redirected to the cef-exception subinterface:
•IP Packets with IP options.
•IP Packets with TTL less than or equal to 1.
Protocols Auto-detected by the Port-filter
Some Cisco IOS TCP/UDP-based services, when configured, may not be auto-detected by the port-filter. That is, they do not get listed under the show control-plane host open ports output and they are not classified as an open port. This type of port must be manually added to the active port-filter class-map to be unblocked.
Control-plane Policing Subinterface Restrictions
There are no restrictions on existing aggregate control-plane policing policies. New control-plane policing policies that are configured on host subinterface will not process ARP traffic since ARP traffic is processed at the cef-exception and aggregate interfaces.
Information About Control Plane Protection
To configure the Control-plane Policing feature, you should understand the following concepts:
•Benefits of Control Plane Protection
•Control Plane Protection Architecture
•Control-plane Interface and Subinterfaces
Benefits of Control Plane Protection
Configuring the Control Plane Protection feature on your Cisco router provides the following benefits:
•Extends protection against DoS attacks at infrastructure routers by providing mechanism for finer policing granularity for control-plane traffic that allows you to rate-limit each type individually.
•Provides a mechanism for early dropping of packets that are directed to closed or nonlistened IOS TCP/UDP ports.
• Provides ability to limit protocol queue usage such that no single protocol flood can overwhelm the input interface.
•Provides QoS control for packets that are destined to the control-plane of Cisco routers.
• Provides ease of configuration for control plane policies using MQC Infrastructure.
•Provides better platform reliability, security and availability.
•Provides dedicated control-plane subinterface for aggregate, host, transit and cef-exception control-plane traffic processing.
•Is highly flexible: permit, deny, rate-limit.
•Provides CPU protection so it can be used for important jobs, such as routing.
Control Plane Protection Architecture
Figure 1 shows control-plane architecture with the Control Plane Protection feature.
Figure 1 Control-plane Architecture with Control Plane Protection
The following sections describe the components of the Control Plane Protections feature.
Control-plane Interface and Subinterfaces
Control Plane Policing (CoPP) introduced the concept of early rate-limiting protocol specific traffic destined to the processor by applying QoS policies to the aggregate control-plane interface. Control Plane Protection extends this control plane functionality by providing three additional control-plane subinterfaces under the top-level (aggregate) control-plane interface. Each subinterface receives and processes a specific type of control-plane traffic. The three subinterfaces are:
•Control-plane host subinterface. This interface receives all control-plane IP traffic that is directly destined for one of the router interfaces. Examples of control-plane host IP traffic include tunnel termination traffic, management traffic or routing protocols such as SSH, SNMP, BGP, OSPF, and EIGRP. All host traffic terminates on and is processed by the router. Most control plane protection features and policies operate strictly on the control-plane host subinterface. Since most critical router control plane services, such as routing protocols and management traffic, is received on the control-plane host subinterface, it is critical to protect this traffic through policing and protection policies. CoPP, port-filtering and per-protocol queue thresholding protection features can be applied on the control-plane host subinterface.
Note Non-IP based Layer 2 protocol packets such as ARP or CDP do not fall within the control-plane host subinterface. These packets are currently classified in the control-plane CEF-exception subinterface traffic.
•Control-plane transit subinterface. This subinterface receives all control-plane IP traffic that is software switched by the route processor. This means packets that are not directly destined to the router itself but rather traffic traversing through the router. Nonterminating tunnels handled by the router is an example of this type of control-plane traffic. Control Plane Protection allows specific aggregate policing of all traffic received at this subinterface.
•Control-plane CEF-exception subinterface. This control-plane subinterface receives all traffic that is either redirected as a result of a configured input feature in the CEF packet forwarding path for process switching or directly enqueued in the control plane input queue by the interface driver (i.e. ARP, L2 Keepalives and all non-IP host traffic). Control Plane Protection allows specific aggregate policing of this type of control plane traffic.
QoS policies attached on any of the control-plane interfaces or subinterfaces execute at interrupt level prior to packets being enqueued to the IP input queue and sent to the processor.
The transit and CEF-exception control plane subinterfaces exist in parallel to the control plane host subinterface. This release of Control Plane Protection allows for rate-limiting policies to be configured on these paths as Control Plane Policing extensions. The port-filtering and per-protocol queue thresholding features are not available on these control-plane subinterfaces.
All protection features in the control plane are implemented as MQC policies that operate using the control plane class-maps and policy-maps. New class-map and policy-map types have been created for the control plane port-filter and per-protocol queue-threshold features.
Port-filtering
The control-plane Port-filtering feature enhances control plane protection by providing for early dropping of packets directed toward closed or nonlistened IOS TCP/UDP ports on the router. The port-filter feature policy can be applied only to the control-plane host subinterface.
The port-filter maintains a global database of all open TCP and UDP ports on the router, including random ephemeral ports created by applications. The port database is dynamically populated with entries provided by the registered applications as they start listening on their advertised ports either by configuration of an application (that is SNMP) or initiation of an application (that is, TFTP transfer). An MQC class-map using the list of open ports can be configured and a simple drop policy can be applied to drop all packets destined to closed or nonlistened ports. Port-filter class-maps also support direct match of any user configured TCP/UDP port numbers.
Queue-thresholding
Control-plane protocol Queue-thresholding feature provides a mechanism for limiting the number of unprocessed packets a protocol can have at process-level. This feature can only be applied to the control-plane host subinterface. The intent of this feature is to prevent the input queue from being overwhelmed by any single protocol traffic. Per-protocol thresholding follows a protocol charge model. Each protocol's queue usage is limited such that no single mis-behaving protocol process can jam the interface hold queue. In this release, only a subset of TCP/UDP protocols can be configured for thresholding. Non-IP and Layer 2 protocols such as ARP and CDP cannot be configured. You can set queue limits for the following protocols:
•bgp—Border Gateway Protocol
•dns—Domain Name Server lookup
• ftp—File Transfer Protocol
• http—World Wide Web traffic
• igmp— Internet Group Management Protocol
•snmp—Simple Network Management Protocol
•ssh—Secure Shell Protocol
•syslog—Syslog Server
• telnet—Telnet
•tftp—Trivial File Transfer Protocol
•host-protocols—A wild card for all TCP/UDP protocol ports open on the router not specifically matched/configured
Aggregate Control-plane Services
Control-plane Policing is an existing Cisco IOS feature that allows QoS policing of aggregate control-plane traffic destined to the route processor. The Control Plane Protection feature enhances protection for the router's control-plane by providing finer granularity of policing of traffic destined to the router's processor entering through any of the three control-plane subinterfaces. The CoPP feature is intended to be the first Control Plane Protection feature encountered by packets before any other features/policies. Existing (aggregate) Control-plane Policing policies will not be affected when the Control Plane Protection functionality is enabled. The aggregate Control-plane Policing policy will be applied on all control-plane traffic types. However, Control Plane Protection allows for additional and/or separate Control-plane Policing policies to be configured and applied on the different types of control-plane subinterfaces (host, transit, CEF-exception).
How to Configure Control Plane Protection
The CLI for control-plane (introduced with the Control Plane Policing feature) has been extended to allow for CoPP policies to be applied to individual control-plane subinterfaces (host, transit, CEF-exception). The command syntax for creating CoPP Service Policies remains the same. In addition, the MQC class-map and policy-map CLI was modified to allow for additional types. The port-filter and queue-threshold policy features available in the host subinterface uses these new class-map and policy-map "types".
CoPP leverages MQC to define traffic classification criteria and to specify configurable policy actions for the classified traffic. Traffic of interest must first be identified via class-maps, which are used to define packets for a particular traffic class. Once classified, enforceable policy actions for the identified traffic are created with policy-maps. The control-plane global command allows the control-plane service policies to be attached to the aggregate control-plane interface itself.
The CLI for configuring Control-plane Policing policies on the new control-plane subinterfaces remains basically the same as the CLI introduced for Control-plane Policing. The only difference is in how you apply or attach the CoPP policy to the different control-plane subinterfaces.
•Defining Packet Classification Criteria for CoPP (required)
•Defining a CoPP Service Policy (required)
•Entering Control Plane Configuration Mode (required)
•Applying CoPP Service Policy (required)
•Configuring Port-filter Policy (optional)
•Configuring Queue-threshold Policy (optional)
•Verifying Control Plane Protection (optional)
Defining Packet Classification Criteria for CoPP
Perform this task to define the packet classification criteria for CoPP.
Prerequisites
Before you attach an existing QoS policy to the control-plane subinterface, you must first create the policy using the MQC to define a class map and policy map for control-plane traffic.
For information about how to classify traffic and create a QoS policy, see the "Applying QoS Features Using the MQC" module.
Restrictions
•The Control-plane Policing feature requires the MQC to configure packet classification and policing. Thus, restrictions that apply to MQC also apply to control-plane policing.
•Only the following classification (match) criteria are supported: standard and extended IP access lists (named or numbered) and the match ip dscp command, the match ip precedence command, and the match protocol arp command.
•The control-plane policing CLI does not support "type" extensions available with other protection features. This is to preserve backward-compatibility.
SUMMARY STEPS
1. enable
2. configure terminal
3. class-map [match-any | match-all]
4. match {access-group | name access-group-name}
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
configure terminal
Example:
Router# configure terminal
|
Enters global configuration mode.
|
Step 3
|
class-map [match-any | match-all]
class-map-name
Example:
Router(config)# class-map match-any
control-plane-class
|
Enables class map global configuration command mode used to create a traffic class.
•match-any—Specifies that one of the match criterion must be met for traffic entering the traffic class to be classified as part of the traffic class.
•match-all—Specifies that all match criterion must be met for traffic entering the traffic class to be classified as part of the traffic class.
•class-map-name—Specifies the user-defined name of the traffic class. Names can be a maximum of 40 alphanumeric characters.
|
Step 4
|
match {access-group | name access-group-name}
Example:
Router(config-cmap)# match access-group name
cpp-igp-acl
|
Specifies the match criteria for the class-map.
|
Defining a CoPP Service Policy
To define a service policy, use the policy-map global configuration command to specify the service policy name, and use the configuration commands to associate a traffic class that was configured with the class-map command, with the QoS action. The traffic class is associated with the service policy when the class command is used. You must issue the class command after entering policy-map configuration mode. After entering the class command, you are automatically in policy-map class configuration mode.
For information about how to classify traffic and create a QoS policy, see the "Applying QoS Features Using the MQC" module.
Restrictions
•Platform-specific restrictions, if any, are checked when the service policy is applied to the control-plane interface.
•The Control-plane Policing feature requires the modular QoS command-line interface (CLI) (MQC) to configure packet classification and policing. Thus, restrictions that apply to MQC also apply to control-plane policing. Also, only two MQC actions are supported in policy maps - police and drop.
•Support for output policing is available only in Cisco IOS Release 12.3(4)T and later T-train releases, and only on the aggregate control-plane interface. Only input policing is available on the new control-plane host, transit and CEF-exception subinterfaces. (Note that output policing does not provide any performance benefits. It simply controls the information that is leaving the device.)
SUMMARY STEPS
1. enable
2. configure terminal
3. policy-map policy-map-name
4. class class-name
5. police rate [burst-normal] [burst-max] conform-action action exceed-action action [violate-action action]
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
configure terminal
Example:
Router# configure terminal
|
Enters global configuration mode.
|
Step 3
|
policy-map policy-map-name
Example:
Router(config)# policy-map control-plane-policy
|
Enters policy map configuration mode to define a policy.
•policy-map-name—Name of a service policy map. The name can be a maximum of 40 alphanumeric characters.
|
Step 4
|
class class-name
Example:
Router(config-pmap)# class control-plane-class
|
Enters class map configuration mode, which is used to associate a service policy with a class.
•class-name —Name of a service policy class. The name can be a maximum of 40 alphanumeric characters.
|
Step 5
|
police rate [burst-normal] [burst-max]
conform-action action exceed-action action
[violate-action action]
Example:
Router(config-pmap-c)# police rate 50000 pps
conform-action transmit exceed-action drop
|
To configure traffic policing, use the police command in policy-map class configuration mode or policy-map class police configuration mode.
•rate—Specifies the police rate. If the police rate is specified in pps, the valid value range is 1 to 2000000. If the police rate is specified in bps, the valid range of values is 8000 to 10000000000.
•pps—(Optional) Packets per second (pps) will be used to determine the rate at which traffic is policed.
•conform-action action—Action to take on packets that conform to the rate limit.
•exceed-action action—Action to take on packets that exceed the rate limit.
|
Entering Control Plane Configuration Mode
After you have created a class of traffic and defined the service policy for the control-plane, apply the policy to either the aggregate control-plane interface or one of the subinterfaces.
Restrictions
•Platform-specific restrictions, if any, are checked when the service policy is applied to the control-plane interface.
•Support for output policing is available only in Cisco IOS Release 12.3(4)T and later T-train releases, and only on the aggregate control-plane interface. Only input policing is available on the new control-plane host, transit and CEF-exception subinterfaces. (Note that output policing does not provide any performance benefits. It simply controls the information that is leaving the device.)
SUMMARY STEPS
1. enable
2. configure terminal
3. control-plane [host |transit | cef-exception ]
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
configure terminal
Example:
Router# configure terminal
|
Enters global configuration mode.
|
Step 3
|
control-plane [host|transit|cef-exception]
Example:
Router(config)# control-plane
|
Enters control-plane configuration mode to attach a QoS policy that manages CP traffic to specified control-plane subinterface:
•host—enters control-plane host subinterface configuration mode.
•transit—enters control-plane transit subinterface configuration mode.
•cef-exception—enters control-plane cef-exception subinterface configuration mode.
|
Applying CoPP Service Policy
Perform this task to apply CoPP service policies to a control-plane interface.
Prerequisites
Before you attach an existing QoS policy to the control-plane, you must first create the policy by using MQC to define a class map and policy map for control-plane traffic.
For information about how to classify traffic and create a QoS policy, see the "Applying QoS Features Using the MQC" module.
Restrictions
•Platform-specific restrictions, if any, are checked when the service policy is applied to the control-plane interface.
•Support for output policing is available only in Cisco IOS Release 12.3(4)T and later T-train releases, and only on the aggregate control-plane interface. Only input policing is available on the new control-plane host, transit and CEF-exception subinterfaces. (Note that output policing does not provide any performance benefits. It simply controls the information that is leaving the device.)
SUMMARY STEPS
1. enable
2. configure terminal
3. control-plane [host | transit | cef-exception]
4. service-policy {input | output} policy-map-name
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
configure terminal
Example:
Router# configure terminal
|
Enters global configuration mode.
|
Step 3
|
control-plane [host | transit | cef-exception]
Example:
Router(config)# control-plane host
|
Attaches a QoS policy that manages CP traffic to a specified subinterface, and enters the control-plane configuration mode.
•host—applies policies to host control-plane traffic
•transit— applies policies to transit control-plane traffic
•cef-exception—applies policies to CEF-exception control-plane traffic
|
Step 4
|
service-policy {input | output} policy-map-name
Example:
Router(config-cp)# service-policy input
control-plane-policy
|
Attaches a QoS service policy to the control-plane.
•input—Applies the specified service policy to packets received on the control-plane.
•output—Applies the specified service policy to packets transmitted from the control-plane and enables the router to silently discard packets.
•policy-map-name—Name of a service policy map (created by using the policy-map command) to be attached. The name can be a maximum of 40 alphanumeric characters.
|
Configuring Port-filter Policy
You can apply the port-filter policy feature to the control-plane host subinterface to block traffic destined to closed or nonlistened TCP/UDP ports. New class-map and service-policy types have been created to accommodate the port-filter configuration. The classification and match criteria for the new port-filter class-maps supports only a constrained subset of the overall global MQC match criteria. Also, the actions supported by the new port-filter service policy is limited as well. that is only the drop action is supported
Restrictions
•The classification and match criteria for the new port-filter class-maps support only a constrained subset of the overall global MQC match criteria.
•The actions supported by the new port-filter service policy is limited. Only the drop action is supported.
• The port-filter feature policy can only be attached on the control-plane host subinterface.
•Some IOS TCP/UDP-based services, when configured, may not be auto-detected by the port filter. That is, they do not get listed under the "show control plane host open ports" output and are not classified as an open port. This type of port must be manually added to the active port filter class-map to be unblocked when using the `closed-port' match criteria.
There are three required steps to configure a port-filter policy:
•Defining Port-filter Packet Classification Criteria
•Defining Port-filter Service Policy
•Applying Port-filter Service Policy to the Host Subinterface.
Defining Port-filter Packet Classification Criteria
Before you can attach a port-filter service policy to the control-plane host subinterface, you must first create the policy using the modified MQC to define a port-filter class-map and policy-map type for control-plane traffic.
A new MQC class-map type called port-filter was created for the port-filter feature. You must first create one or more port-filter class-map(s) before you can create your port-filter service policy. Your port-filter class-maps will separate your traffic into "classes" of traffic in which your service policy will define actions on.
Restrictions
•The classification and match criteria for the new port-filter class-maps supports only a constrained subset of the overall global MQC match criteria. That is, only a subset of match protocol criteria is supported.
• Some IOS TCP/UDP-based services, when configured, may not be auto-detected by the port filter. That is, they do not get listed under the "show control plane host open ports" output and are not classified as an open port. This type of port must be manually added to the active port filter class-map to be unblocked when using the `closed-port' match criteria.
SUMMARY STEPS
1. enable
2. class-map type port-filter [match-all | match-any] class-name
3. match {closed-ports | not | ports}
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
class-map type port-filter [match-all |
match-any] class name
Example:
Router(config)# class-map type port-filter
match-all pf-class
|
Creates a class map used to match packets to a specified class and enables the port-filter class-map configuration mode.
•match-all —performs a logical AND on the match criteria
•match-any—performs a logical OR on the match criteria
•class-name—Name of a service policy class. The name can be a maximum of 40 alphanumeric characters.
|
Step 3
|
match {closed-ports|not|port} {TCP|UDP} 0-65535
Example:
Router(config-cmap)# match closed-ports
|
Specifies the TCP/UDP match criteria for the class-map
•Closed-ports—matches automatically on all closed-ports on the router
• Port—allows you to manually specify a TCP/UDP port to match on.
•TCP—specifies a TCP port to match on
•UDP—specifies an UDP port to match on
|
Defining Port-filter Service Policy
You can define a port-filter service policy that provides additional control-plane protection. Defining this policy supports early dropping of packets that are directed toward closed on nonlistened TCP/UDP ports on the router.
To configure a Port-filter service policy, use the new policy-map type port-filter global configuration command to specify the port-filter service policy name, and use the following configuration commands to associate a port-filter traffic class that was configured with the class-map type port-filter command, with the port-filter drop action command. The port-filter traffic class is associated with the service policy when the class command is used. The class command must be issued after entering policy-map configuration mode. After entering the class command, you are automatically in policy-map class configuration mode.
Restrictions
The actions supported by the new port-filter service policy is limited. Only the drop action is supported.
SUMMARY STEPS
1. enable
2. configure terminal
3. policy-map type port-filter policy-map-name
4. class class-name
5. drop
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
configure terminal
Example:
Router# configure terminal
|
Enters global configuration mode.
|
Step 3
|
policy-map type port-filter policy-map-name
Example:
Router(config-pcmap)# policy-map type
port-filter cppr-pf-policy
|
Creates the port-filter service policy and enters the policy-map configuration mode.
•policy-map-name—Name of a service policy map. The name can be a maximum of 40 alphanumeric characters.
|
Step 4
|
class class name
Example:
Router (config-cmap)# class pf-class
|
Associates a service policy with a class and enters class map configuration mode.
•class-name—Name of a service policy class. The name can be a maximum of 40 alphanumeric characters.
|
Step 5
|
drop
Example:
Router (config-cmap)# drop
|
Applies the port-filter service policy action on the class.
|
Applying Port-filter Service Policy to the Host Subinterface
Perform this task to apply port-filter service policies to a subinterface.
Prerequisites
Before you attach a port-filter service policy to the control-plane host subinterface, you must first create the policy using MQC to define a class map and policy map for the required control-plane traffic.
Restrictions
The port-filter feature can only be applied on the control-plane host subinterface and only as input policy.
SUMMARY STEPS
1. enable
2. configure terminal
3. control-plane [host | transit | cef-exception]]
4. service-policy type port-filter {input} port-filter-policy-map-name
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
configure terminal
Example:
Router# configure terminal
|
Enters the global configuration mode.
|
Step 3
|
control-plane [host | transit | cef-exception]
Example:
Router(config)# control-plane host
|
Attaches a QoS policy that manages traffic to the control-plane host subinterface and enters the control-plane configuration mode.
Note Port-filter can only be applied to the host subinterface.
•host—enters the control-plane host subinterface configuration mode
|
Step 4
|
service-policy type port-filter {input}
port-filter-policy-map-name
Example:
Router(config-cp)# service-policy input
cppr-pf-policy
|
Attaches a QoS service policy to the control-plane host subinterface.
•input— Applies the specified service policy to packets received on the control-plane.
•port-filter-policy-map-name—Name of a port-filter service policy map (created using the policy-map type port-filter command) to be attached. The name can be a maximum of 40 alphanumeric characters.
|
Examples
The following example shows how to configure a port-filter policy to drop all traffic destined to closed or "nonlistened" TCP/UDP ports:
Router(config)# class-map type port-filter pf-class
Router(config-cmap)# match closed-ports
Router(config-cmap)# exit
Router(config)# policy-map type port-filter pf-policy
Router(config-pmap)# class pf-class
Router(config-pmap-c)# drop
Router(config-pmap-c)# end
The following example shows how to configure a port-filter policy to drop all traffic destined to closed or "nonlistened" ports except NTP.
Router(config)# class-map type port-filter pf-class
Router(config-cmap)# match not port udp 123
Router(config-cmap)# match closed-ports
Router(config-cmap)# exit
Router(config)# policy-map type port-filter pf-policy
Router(config-pmap)# class pf-class
Router(config-pmap-c)# drop
Router(config-pmap-c)# end
Configuring Queue-threshold Policy
TheControl Plane Protection feature includes a new queue-threshold policy feature that can be applied to the control-plane host subinterface. The queue-threshold feature allows you to limit the number of packets for a given higher level protocol allowed in the control-plane IP input queue. Much like the port-filter feature, new class-map and policy-map types have been created to accommodate the queue-threshold feature. As with the port-filter feature, the queue-threshold feature supports a very specific class-map and policy-map capabilities.
Restrictions
•The classification and match criteria for the new queue-threshold class-maps supports only a constrained subset of the overall global MQC match criteria. That is, only a subset of match protocol option.
•The actions supported by the new queue-threshold service policy is limited. Only the queue-limit action is supported.
•The queue-threshold feature is supported only on the control-plane host subinterface as an input policy.
There are three steps required to configure a Queue-threshold policy:
•Defining Queue-threshold Packet Classification Criteria
•Defining a Queue-threshold Service Policy
•Applying a Queue-threshold policy to the Host Subinterface
Defining Queue-threshold Packet Classification Criteria
You can define a queue-threshold service policy when you want to limit the number of unprocessed packets that a protocol can have at process level.
Before you can attach a queue-threshold service policy to the control-plane host subinterface, you must first create the policy using the modified MQC to define a queue-threshold class-map and policy-map type for control-plane traffic.
A new MQC class-map type called queue-threshold was created for the queue-threshold feature. You must first create one or more queue-threshold class-map(s) before you can create your queue-threshold service policy. Your queue-threshold class-maps will separate your traffic into "classes" of traffic in which your service policy will define actions on.
Restrictions
The classification and match criteria for the new queue-threshold class-map supports only a constrained subset of the overall global MQC match criteria. That is, only a subset of the match protocol criteria is supported.
SUMMARY STEPS
1. enable
2. configure terminal
3. class-map type queue-threshold [match-all | match-any] class name
4. match protocol [bgp | dns | ftp | http | igmp | snmp | ssh | syslog | telnet | tftp] [cr]
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
configure terminal
Example:
Router# configure terminal
|
Enters the global configuration mode.
|
Step 3
|
class-map type queue-threshold [match-all |
match-any] class name
Example:
Router(config)#class-map type queue-threshold
match-all cppr-pf
|
Applies a class map for the queue-threshold and enables the queue-threshold class-map configuration mode.
•match-all—performs a logical AND on the match criteria
•match-any—performs a logical OR on the match criteria
•class-name—Name of a service policy class. The name can be a maximum of 40 alphanumeric characters.
|
Step 4
|
match protocol
[bgp|dns|ftp|http|igmp|snmp|ssh|syslog|telnet|t
ftp|host-protocols]
Example:
Router(config-cmap)# match protocol bgp
|
Specifies the upper layer protocol match criteria for the class-map.
•bgpBorder Gateway Protocol
•dns—Domain Name Server lookup
•ftp—File Transfer Protocol
•http—World Wide Web traffic
•igmp—Internet Group Management Protocol
•snmp—Simple Network Management Protocol
•ssh—Secure Shell Protocol
•syslog—Syslog Server
•telnet—Telnet
•tftp—Trivial File Transfer Protocol
•host-protocols—any open TCP/UDP port on the router.
|
Defining a Queue-threshold Service Policy
To configure a queue-threshold service policy, use the new policy-map type called queue-threshold global configuration command to specify the queue-threshold service policy name, and use the following configuration commands to associate a queue-threshold traffic class that was configured with the class-map type queue-threshold command, with the queue-threshold queue-limit action command. The queue-threshold traffic class is associated with the service policy when the class command is used. The class command must be issued after entering policy-map configuration mode. After entering the class command, you are automatically in policy-map class configuration mode.
Restrictions
The actions supported by the new queue-threshold service policy is limited. Only the queue-limit action is supported.
SUMMARY STEPS
1. enable
2. configure terminal
3. policy-map type queue-threshold policy-name
4. class class name
5. queue-limit number
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
configure terminal
Example:
Router# configure terminal
|
Enters the global configuration mode.
|
Step 3
|
policy-map type queue-threshold policy name
Example:
Router(config)# policy-map type queue-threshold
cppr-qt-policy
|
Enables the queue-threshold service policy configuration mode.
• policy-name—Name of a service policy map. The name can be a maximum of 40 alphanumeric characters.
|
Step 4
|
class class name
Example:
Router(config-pcmap)# class qt-class
|
Enters class map configuration mode used to associate a service policy with a class.
• class-name—Name of a service policy class. The name can be a maximum of 40 alphanumeric characters.
|
Step 5
|
queue-limit number
Example:
Router(config-cmap) #queue-limit 75
|
Applies the queue-threshold service policy action on the class.
Note Queue limit range is 0 to 255.
|
Applying a Queue-threshold policy to the Host Subinterface
Perform this task to apply queue-threshold service policies to the control-plane host subinterface.
Prerequisites
Before you attach a queue-threshold service policy to the control-plane host subinterface, you must first create the policy by using MQC to define a class map and policy map for the required control-plane traffic.
Restrictions
The queue-threshold feature can only be applied on the control-plane host subinterface as an input policy.
SUMMARY STEPS
1. enable
2. configure terminal
3. control-plane [host | transit | cef-exception]
4. service-policy type queue-threshold {input} queue-threshold-policy-map-name
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
configure terminal
Example:
Router# configure terminal
|
Enters the global configuration mode.
|
Step 3
|
control-plane [host | transit | cef-exception]
Example:
Router(config)# control-plane host
|
Attaches a QoS queue-threshold policy that manages traffic to the host subinterface and enters control-plane configuration mode.
Note queue-threshold can only be applied to the host subinterface.
• host—Enters the control-plane host subinterface configuration mode.
|
Step 4
|
service-policy type queue-threshold {input}
queue-threshold-policy-map-name
Example:
Router(config-cp)# service-policy input
cppr-qt-policy
|
Attaches a QoS service policy to the control-plane.
• input—Applies the specified service policy to packets received on the control-plane.
•queue-threshold-policy-map-name —Name of a queue-threshold service policy map (created using the policy-map type queue-threshold command) to be attached. The name can be a maximum of 40 alphanumeric characters.
|
Examples
The following example shows how to configure a queue-threshold policy to set the queue limit for SNMP protocol traffic to 50, telnet traffic to 50, and all other protocols to 150.
Router(config)# class-map type queue-threshold qt-snmp-class
Router(config-cmap)# match protocol snmp
Router(config-cmap)# class-map type queue-threshold qt-telnet-class
Router(config-cmap)# match protocol telnet
Router(config-cmap)# class-map type queue-threshold qt-other-class
Router(config-cmap)# match host-protocols
Router(config-cmap)# exit
Router(config)# policy-map type queue-threshold qt-policy
Router(config-pmap)# class qt-snmp-class
Router(config-pmap-c)# queue-limit 50
Router(config-pmap-c)# class qt-telnet-class
Router(config-pmap-c)# queue-limit 50
Router(config-pmap-c)# class qt-other-class
Router(config-pmap-c)# queue-limit 150
Router(config-pmap-c)# end
Verifying Control Plane Protection
Use the show policy-map control-plane command to verify Control Plane Protection configurations and to view statistics for control-plane service policies.
To display information about the service policy attached to the control-plane, perform the following optional steps.
SUMMARY STEPS
1. enable
2. show policy-map [type policy-type] control-plane [pfx | slot slot number] [all] [host | transit | cef-exception] [{input | output} [class class-name]]
DETAILED STEPS
|
Command or Action
|
Purpose
|
Step 1
|
enable
Example:
Router> enable
|
Enables privileged EXEC mode.
•Enter your password if prompted.
|
Step 2
|
show policy-map [type policy-type]
control-plane [pfx | slot slot number] [all]
[host | transit | cef-exception] [{input |
output} [class class-name]]
Example:
Router# show policy-map control-plane all
|
Displays information about the control-plane.
•policy-type— Specifies policy-map type that you want statistics for (i.e. port-filter or queue-threshold)
•pfx— Does not apply to Control Plane Protection feature.
•slot— Does not apply to Control Plane Protection feature
•all—Information for all control plane interfaces.
•host —Policy-map and class-map statistics for the host path.
•transit—Policy-map and class-map statistics for transit path.
•cef-exception—Policy-map and class-map statistics for CEF-exception path.
•input—Statistics for the attached input policy will be displayed.
•output—Statistics for the attached output policy will be displayed.
•class class name—Name of class whose configuration and statistics are to be displayed.
|
Examples
The following example shows that the aggregate CoPP policy map named "copp-transit-policy" is associated with the control-plane transit subinterface and displays the statistics for that policy:
Router# show policy-map control-plane transit
Service-policy input: copp-transit-policy
Class-map: copp-transit-class (match-all)
5 minute offered rate 0 bps, drop rate 0 bps
rate 2000 pps, burst 488 packets
conformed 8 packets; actions:
exceeded 0 packets; actions:
conformed 0 pps, exceed 0 pps
Class-map: class-default (match-any)
5 minute offered rate 0 bps, drop rate 0 bps
The following example shows that the policy map "TEST" is associated with the aggregate control-plane interface. This policy map polices traffic that matches the class map "TEST," while allowing all other traffic (that matches the class map "class-default") to go through as is.
Router# show policy-map control-plane
Service-policy input:TEST
Class-map:TEST (match-all)
5 minute offered rate 0 bps, drop rate 0 bps
8000 bps, 1500 limit, 1500 extended limit
conformed 15 packets, 6210 bytes; action:transmit
exceeded 5 packets, 5070 bytes; action:drop
violated 0 packets, 0 bytes; action:drop
conformed 0 bps, exceed 0 bps, violate 0 bps
Class-map:class-default (match-any)
105325 packets, 11415151 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Additional References
The following sections provide references related to Control-Plane Protection.
Related Documents
Standards
Standard
|
Title
|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
|
—
|
MIBs
MIB
|
MIBs Link
|
•CISCO-CLASS-BASED-QOS-MIB
Note Supported only in Cisco IOS Release 12.3(7)T.
|
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator, found at the following URL:
http://www.cisco.com/go/mibs
|
RFCs
Technical Assistance
Description
|
Link
|
The Cisco Technical Support website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.
|
http://www.cisco.com/techsupport
|
Command Reference
The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS Quality of Service Solutions Command Reference at http://www.cisco.com/en/US/docs/ios/qos/command/reference/qos_book.html. For information about all Cisco IOS commands, use the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or a Cisco IOS master commands list.
•class-map
•control-plane
•show policy-map control-plane
CCDE, CCENT, Cisco Eos, Cisco Lumin, Cisco Nexus, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, the Cisco logo, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0809R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007 Cisco Systems, Inc. All rights reserved.