Copp And The Management Interface; Licensing Requirements For Copp; Guidelines And Limitations For Copp - Cisco Nexus 9000 Series Configuration Manual

CoPP and the Management Interface

CoPP and the Management Interface
The Cisco NX-OS device supports only hardware-based CoPP, which does not support the management
interface (mgmt0). The out-of-band mgmt0 interface connects directly to the CPU and does not pass through
the in-band traffic hardware where CoPP is implemented.
On the mgmt0 interface, ACLs can be configured to give or deny access to a particular type of traffic.
Related Topics

Licensing Requirements for CoPP

The following table shows the licensing requirements for this feature:
Product
Cisco NX-OS

Guidelines and Limitations for CoPP

CoPP has the following configuration guidelines and limitations:
• We recommend that you use the strict default CoPP policy initially and then later modify the CoPP
• Customizing CoPP is an ongoing process. CoPP must be configured according to the protocols and
• We recommend that you continuously monitor CoPP. If drops occur, determine if CoPP dropped traffic
• All the traffic that you do not specify in the other class maps is put into the last class, the default class.
• All broadcast traffic is sent through CoPP logic in order to determine which packets (for example, ARP
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
470
Configuring IP ACLs
Configuring MAC ACLs
policies based on the data center and application requirements.
features used in your specific environment as well as the supervisor features that are required by the
server environment. As these protocols and features change, CoPP must be modified.
unintentionally or in response to a malfunction or attack. In either event, analyze the situation and evaluate
the need to modify the CoPP policies.
Monitor the drops in this class and investigate if these drops are based on traffic that you do not want or
the result of a feature that was not configured and you need to add.
and DHCP) need to be redirected through an access control list (ACL) to the router processor. Broadcast
traffic that does not need to be redirected is matched against the CoPP logic, and both conforming and
violated packets are counted in the hardware but not sent to the CPU. Broadcast traffic that needs to be
sent to the CPU and broadcast traffic that does not need to be sent to the CPU must be separated into
different classes.
Configuring Control Plane Policing
License Requirement
CoPP requires no license. Any feature not included
in a license package is bundled with the nx-os image
and is provided at no extra charge to you. For an
explanation of the Cisco NX-OS licensing scheme,
see the Cisco NX-OS Licensing Guide.