Configuring Control-Plane Security - Cisco ME 3400 Software Configuration Manual

Configuring Control-Plane Security

•
You can configure only the rate-limiting threshold. The configured threshold applies to all supported
control protocols on all UNIs and ENIs. It also applies to STP, CDP, LLDP, LACP, and PAgP when the
protocol is enabled on an ENI.
During normal Layer 2 operation, you cannot ping the switch through a UNI or ENI. This restriction
Note
does not apply to NNIs. See the
situation.
Beginning in privileged EXEC mode, follow these steps to set the threshold rate for CPU protection:
Command
Step 1 configure terminal
Step 2
policer cpu uni rate
Step 3 end
Step 4
show policer cpu uni-eni rate
Step 5 copy running-config startup-config
To return to the default threshold rate, use the no policer cpu uni global configuration command. To
disable CPU protection, enter the no policer cpu uni all global configuration command, and reload the
switch.
This example shows how to set the CPU protection threshold to 10000 b/s and to verify the configuration.
Switch# config t
Enter configuration commands, one per line.
Switch(config)# policer cpu uni 10000
Switch(config)# end
Switch# show policer cpu uni-eni rate
CPU UNI/ENI port police rate = 10000 bps
This is an example of the show command output when CPU protection is disabled.
Switch# show policer cpu uni-eni rate
CPU Protection feature is not enabled
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
32-6
If you disable CPU protection and attach a policy map with more than 45 policers, and then enable
CPU protection again, and reload, 19 policers per port are again required for CPU protection. During
reload, the policers 46 and above will reach the policer resources exceeded error condition and no
policers are attached to those classes.
"Using Ping" section on page 44-10
Purpose
Enter global configuration mode.
Configure the CPU protection policing threshold rate. The range is
from 8000 to 409500 bits per second (b/s). The default, if none is
configured, is 160000 b/s.
The configured rate applies to all supported and enabled
Note
control protocols on all UNIs and ENIs
Return to privileged EXEC mode.
Verify the configured CPU policer rate.
(Optional) Save your entries in the configuration file.
End with CNTL/Z.
Chapter 32 Configuring Control-Plane Security
for ways to enable ping in a test
OL-9639-07