Cisco 3850 Default CPP

[YusifAlexis22]

I am trying to implement a Control Plane Policy to my 3850 switch. Within this policy I want to restrict SSH access to the switch to only the loopback IP. I found documentation that the default CPP can't be removed. However, is it also not editable? I tried adding my configuration to the existing policy-map and ensured that my policy was at the top of the policy-map, but the traffic isn't being policed. 

Configuartion:

ip access-list extended Restrict_SSH

deny tcp any host 1.1.1.1 eq 22

permit tcp any any eq 22

deny ip any any

!

class-map match-all SSH

match access-group name Restrict_SSH

!

policy-map system-cpp-policy

sequence-interval 10

5 class SSH

drop

!

control-plane

service-policy input system-cpp-policy

[marce1000]

 - Check if this thread can help you :

               https://community.cisco.com/t5/network-management/restricting-telnet-ssh-access-to-loopback-address/td-p/1306161

 M.