- Preface
- Overview
- Using the Command-Line Interface
- Assigning the Switch IP Address and Default Gateway
- Configuring Cisco IOS Configuration Engine
- Administering the Switch
- Configuring Synchronous Ethernet
- Configuring Switch Alarms
- Configuring SDM Templates
- Configuring Switch-Based Authentication
- Configuring Interface Characteristics
- Configuring VLANs
- Configuring Ethernet Virtual Connections (EVCs)
- Configuring Command Macros
- Configuring STP
- Configuring MSTP
- Configuring Optional Spanning-Tree Features
- Configuring Resilient Ethernet Protocol
- Configuring Flex Links and the MAC Address-Table Move Update Feature
- Configuring DHCP Features
- Configuring Dynamic ARP Inspection
- Configuring IGMP Snooping
- Configuring PIM Snooping
- Configuring IEEE 802.1x Port-Based Authentication
- Configuring Traffic Control
- Configuring CDP
- Configuring LLDP and LLDP-MED
- Configuring UDLD
- Configuring System Message Logging
- Configuring RMON
- Configuring SD Flashcard
- Configuring SNMP
- Configuring Embedded Event Manager
- Configuring Network Security with ACLs
- Configuring IPv6 ACLs
- Configuring QoS
- Hierarchical Color-Aware Policing
- Configuring Multi-level Priority Queue
- Configuring Policy Based Routing (PBR)
- Configuring Control Plane Policing (COPP)
- Configuring EtherChannels
- Configuring IP Unicast Routing
- Configuring IPv6 Unicast Routing
- Configuring IPv6 VPN over MPLS
- Configuring VRRP
- Configuring HSRP
- Configuring Cisco IOS IP SLAs Operations
- Configuring Enhanced Object Tracking
- Configuring Ethernet OAM, CFM, and E-LMI
- Configuring Y.1731 Performance Monitoring
- Configuring Ethernet Data Plane Loopback
- L2VPN Protocol-Based CLIs
- Configuring IP Multicast Routing
- Configuring Multicast VPN
- Configuring MPLS, MPLS VPN, MPLS OAM, and EoMPLS
- Multiprotocol Label Switching Load Balancing
- MPLS Traffic Engineering Bundled Interface Support
- Configuring OSPF TTL Security Check
- Configuring Switched Port Analyzer (SPAN)
- Configuring Ethernet Ring Protection Switching
- Troubleshooting
- Configuring Online Diagnostics
- Supported MIBs
- Working with the Cisco IOS File System, Configuration Files, and Software Images
- Configuring MPLS Transport Profile
- Unsupported Commands in Cisco IOS Release 15.3(3)S
- Index
Cisco ME 3800x and ME 3600x Switches Software Configuration Guide, Cisco IOS Release 15.4(1)S
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
- Updated:
- November 17, 2015
Chapter: Configuring Control Plane Policing (COPP)
Configuring Control Plane Policing (CoPP)
The traffic managed by the RP is divided into four functional components or planes :
The control plane policing (CoPP) feature increases security on the switch by protecting the RP from unnecessary or DoS traffic and giving priority to important control plane and management traffic.
The majority of traffic managed by the RP is handled by way of the control and management planes. You can use CoPP to protect the control and management planes, and ensure routing stability, reachability, and packet delivery. CoPP uses a dedicated control plane configuration through the modular QoS CLI (MQC) and the platform dependent CLI to provide filtering and rate-limiting capabilities for the control plane packets.
The switch has default egress policers installed for each of the 20 CPU queues. See Table 1-1 for details of the default rates for CPU.
Configuring CoPP
CoPP uses MQC to define traffic classification criteria and to specify the configurable policy actions for the classified traffic. You must first identify the traffic to be classified by defining a class map. The class map defines packets for a particular traffic class. After you have classified the traffic, you can create policy maps to enforce policy actions for the identified traffic. The control-plane global configuration command allows the CoPP service policies to be directly attached to the control plane.
To modify the rates for input and output policies, such as shown in Table 1-1 Options for Input and Output Policies , use the platform qos policer cpu queue queue-num cir | cb command.
To modify policer values (up to 20 mbps) of the CPU Queues, use the platform qos policer cpu queue queue-num cir | cb command.
Note
Use the platform qos policer cpu queue command in global configuration mode.
To check or clear the policier statistics for a particular CPU queue use the show platform qos policer cpu queue queue-number 0 | 1 command.
Note Before using the platform qos policer cpu queue and show platform qos policer commands, run the service internal command.
To configure CoPP, perform this task:
Example
The following example shows a MAC access-list with a permit rule configured to allow STP packets (DMAC as STP MAC), a class-map is configured to match on the access-list, and linked to a policy. Define a police rate, and attach the policy to the control plane
When defining the packet classification criteria, follow these guidelines and restrictions:
- To avoid matching the filtering and policing that are configured in a subsequent class, configure policing in each class. CoPP does not apply the filtering in a class that does not contain a police command. A class without a police command matches no traffic.
- STP is the only supported protocol for control-place policy-maps.
- MAC-based matching is done in software only.
- You can enter one match command in a single class map only.
When defining the service policy, the police policy-map action is the only supported action.
When applying the service policy to the control plane, the input direction is only supported.
- Hierarchical policy maps are not supported for control plane policies.
- Only one match criterion in supported in the control-plane classes, multiple match criterion cannot be configured. We do not support multiple protocols to be matched in the same class for a CoPP policy, please ensure that one class is configured with the match rules for only one protocol.
- Only 1rate 2 color policer are supported on a class in a CoPP policy. Only transmit and drop actions are supported.
- Classes without a policer for CoPP are not supported, you must attach a policer to each class inside a CoPP policy.
- Once a policy is attached to the control-plane, do not modify the ACLs linked to it, or the match criterion in the classes. Detach the policy, then modify the ACLs or class and re-attach the policy to the control plane.
- The class-default on the CoPP policy does not support policing/stats, all the packets that do not get classified into the CoPP protocol classes will be policed at the policing rate of the corresponding CPU queue that they take.
Monitoring CoPP
You can enter the show policy-map control-plane command for developing site-specific policies, monitoring statistics for the control plane policy, and troubleshooting CoPP. This command displays dynamic information about the actual policy applied, including rate information and the number of bytes (and packets) that conformed or exceeded the configured policies both in hardware and in software.
The output of the show policy-map control-plane command is as follows:
Clearing CoPP policy-map statistics
To clear CoPP policy-map statistics, use the clear control-plane command:
Removing CoPP Configuration
To remove the CoPP configuration, detach the service-policy from the control-plane using the following steps:
|
|
|
|
|---|---|---|
Example
Changing Policier Rate for a Class
When a service-policy is attached to the control-plane, a class can be added to it and a policer attached to it. Classes can be removed from a policy-map that is attached to the control-plane.
Removing a class from the control-plane policy, or detaching the policy-map will lead to the protocol being policed at the default rate of the CPU queue it takes.
To change the policer rate for a class, change the configuration as follows:
Feedback