C H A P T E R 48 Configuring Control Plane Policing And Layer 2 Control Packet Qos - Cisco Catalyst 4500 Series Configuration Manual

Configuring Control Plane Policing
•
•
•
•
•
•
About Control Plane Policing
The control plane policing (CoPP) feature increases security on the Catalyst 4500 series switch by
protecting the CPU from unnecessary or DoS traffic and giving priority to important control plane and
management traffic. The classification TCAM and QoS policers provide CoPP hardware support.
CoPP is supported on the following: Supervisor 6-E and Catalyst 4900M beginning with Cisco IOS
Note
Release 12.2(50)SG; Supervisor 6L-E in Cisco IOS Release 12.2(52)X0; Catalyst 4948-E beginning
with Cisco IOS Release 12.2(54)X0; Supervisor Engine 7-E beginning with Cisco IOS XE 3.1.0SG;
Supervisor Engine 7L-E beginning with Cisco IOS XE 3.2.0XO.
Traffic managed by the CPU is divided into three functional components or planes:
•
•
•
You can use CoPP to protect most of CPU-bound traffic and to ensure routing stability, reachability, and
packet delivery. Most importantly, you can use CoPP to protect the CPU from a DoS attack.
By default, you receive a list of predefined ACLs matching a selected set of Layer 2 and Layer 3 control
plane packets. You can further define your preferred policing parameters for each of these packets and
modify the matching criteria of these ACLs.
The following table lists the predefined ACLs.
Predefined Named ACL
system-cpp-dot1x
system-cpp-lldp
system-cpp-mcast-cfm
system-cpp-ucast-cfm
system-cpp-bpdu-range
system-cpp-cdp
system-cpp-sstp
system-cpp-cgmp
system-cpp-hsrpv2
system-cpp-ospf
system-cpp-igmp
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
48-2
General Guidelines for Control Plane Policing, page 48-3
Default Configuration, page 48-4
Configuring CoPP for Control Plane Traffic, page 48-4
Configuring CoPP for Data Plane and Management Plane Traffic, page 48-5
Control Plane Policing Configuration Guidelines and Restrictions, page 48-8
Policing IPv6 Control Traffic, page 48-16
Data plane
Management plane
Control plane
Chapter 48 Configuring Control Plane Policing and Layer 2 Control Packet QoS
Description
MAC DA = 0180.C200.0003
MAC DA = 0180.C200.000E
MAC DA = 0100.0CCC.CCC0 - 0100.0CCC.CCC7
MAC DA = 0100.0CCC.CCC0
MAC DA = 0180.C200.0000 - 0180.C200.000F
MAC DA = 0100.0CCC.CCCC (UDLD/DTP/VTP/Pagp)
MAC DA = 0100.0CCC.CCCD
MAC DA = 01.00.0C.DD.DD.DD
IP Protocol = UDP, IPDA = 224.0.0.102
IP Protocol = OSPF, IP DA matches 224.0.0.0/24
IP Protocol = IGMP, IP DA matches 224.0.0.0/3
OL-25340-01