Configuring Ip Acl Filtering For Copp - Cisco Nexus 9000 Series Configuration Manual

Configuring Control Plane Policing
Command or Action
switch(config-pmap)# class ClassMap2
switch(config-pmap-c)#
Step 11 Enter one of the following commands:
• police [cir] {cir-rate [rate-type]}
• police [cir] {cir-rate [rate-type]} [bc] burst-size
[burst-size-type]
• police [cir] {cir-rate [rate-type]]} conform transmit
[violate drop]
Example:
switch(config-pmap-c)# police cir 52000 bc 1000
packets
Step 12 control-plane Dynamic mode
Example:
switch(config)# control-plane dynamic mode
switch(config-cp-dyn)#
Step 13 service-policy-dynamic input policy-map-name
Example:
switch(config-cp-dyn)# service-policy-dynamic
input PolicyMap1

Configuring IP ACL Filtering for CoPP

You can configure IP ACL filtering at egress CoPP.
Before you begin
Ensure that you have configured a control plane policy map.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12. Enter one of the following commands:
configure terminal
[no] hardware access-list tcam region erg-copp size
copy running-config startup-config
reload
configure terminal
ip access-list IP-foo-1
permit tcp access-list IP-foo-1 eq bgp
class-map type control-plane [match-all | match-any] class-map-name
(Optional) match access-group name access-list-name
policy-map type control-plane policy-map-name
class {class-map-name [insert-before class-map-name2] | class-default}
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
Configuring IP ACL Filtering for CoPP
Purpose
The class-default class map is always at the end of the
class map list for a policy map.
Specifies the committed information rate (CIR). The rate
range is as follows:
The committed burst (BC) range is as follows:
Enters the control plane dynamic configuration mode.
Specifies a policy map for the input traffic. ENd
483