topic Re: Translate commands from Nexus to 9500 in Network Access Control

Translate commands from Nexus to 9500

marzi — Tue, 29 Aug 2023 14:29:54 GMT

Hi all

I need to translate commands from Nexus3000 (NX-OS 6.0.2) to C9500-24Y4C-E (IOS-XE 17.09.03 Cupertino) commands.

At this time, the Cupertino is suggested.

I've problem translating the following lines which I report an exctact:

class-map type control-plane match-any copp-icmp
match access-group name copp-system-acl-icmp
class-map type control-plane match-any copp-ntp
match access-group name copp-system-acl-ntp

The problem is that IOS-XE doesn't support the "control-plane" command.

Is there a workaround or I'm wrong on it ?

Thanks

Fabrizio

Re: Translate commands from Nexus to 9500

balaji.bandi — Tue, 29 Aug 2023 14:42:34 GMT

nexus os and IOS XE working in different way :

check below Limited CoPP you can do :

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/17-9/configuration_guide/sec/b_179_sec_9500_cg/configuring_control_plane_policing.html

Re: Translate commands from Nexus to 9500

marzi — Wed, 30 Aug 2023 10:18:47 GMT

Thank's for your replay BB

I've read the link posted by you, I need just only a confirm,

If I've understood correctly, on Cisco 9500, CoPP is enabled by default

right ?

Thanks again

Fabrizio

Re: Translate commands from Nexus to 9500

balaji.bandi — Wed, 30 Aug 2023 14:05:42 GMT

its all depends on code running (latest i believe yes)

show policy-map control-plane (check the output).

Re: Translate commands from Nexus to 9500

marzi — Wed, 30 Aug 2023 14:18:54 GMT

Hi BB

The code is following :

Cisco IOS XE Software, Version 17.06.04

and the show policy-map control-plane is ( a snippet only ) :

Service-policy input: system-cpp-policy

Class-map: system-cpp-police-ios-routing (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: none
police:
rate 17000 pps, burst 4150 packets
conformed 1956954814 bytes; actions:
transmit
exceeded 0 bytes; actions:
drop

Class-map: system-cpp-police-ios-feature (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: none
police:
rate 6000 pps, burst 1464 packets
conformed 4193666364 bytes; actions:
transmit
exceeded 0 bytes; actions:
drop

Class-map: system-cpp-police-data (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: none
police:
rate 750 pps, burst 183 packets
conformed 249901089 bytes; actions:
transmit
exceeded 0 bytes; actions:
drop

So, I'd say yes, CoPP is enabled by default.
Anyway, if you have whatever tips or revision, please replay

Thanks again
Fabrizio