IOS IPv6 CoPP

[cardosocristian]

I'm trying to configure IPv6 access for a BGP session and I want to control this through CoPP, to have more control plane security on my Cisco router with IOS, I did an initial configuration and it continues to accept connections from IPs that I didn't include in the ACL, follow my test:

ipv6 access-list eBGPv6
permit tcp host 2804:DB8:1000::1 eq bgp any
deny ipv6 any any
!

class-map match-all CONTROL-PLANE
match access-group name eBGPv6
!
policy-map COPP
class CONTROL-PLANE
police 8000 1500 conform-action transmit exceed-action drop

control-plane
service-policy input COPP

Does anyone happen to use CoPP and could help me?

[MHM Cisco World]

You control rate by CoPP for BGP

What you want to get form this CoPP

MHM

[cardosocristian]

The idea is to only release this IPv6 2804:DB8:1000::1 to connect to the BGP port of my router

[MHM Cisco World]

Check below link

MHM

[Georg Pauwen]

Hello,

I think in any case you need to apply the ACL to the neighbor as well:

neighbor <neighbor IPv6 address> filter-list  eBGPv6 in

[cardosocristian]

Is the idea to apply Control Plane Police to carry out these blockades or is that not what it is for?

[MHM Cisco World]

You can apply ACL in interface but what if you have many interfaces 

So the solution is put it back and config CoPP in CPU. 

MHM

[MHM Cisco World]

https://ccie-or-null.net/tag/copp/

Check this link

MHM

[cardosocristian]

I understood that, I just wanted to understand if my example there is correct or if anyone here has any considerations or configuration examples for me to test and evolve the configuration here, I even used the RFC example and I was unsuccessful.

[MHM Cisco World]

https://sec.cloudapps.cisco.com/security/center/resources/protecting_border_gateway_protocol

MHM

[Harold Ritter]

Hi @cardosocristian ,

The behavior you are seeing is normal. The traffic that does match the class CONTROL-PLANE will be handle by the class default. You can see that using the "show policy-map control-plane" command.

BTW, CoPP is not the best way to block BGP sessions. I would definitely go with an ACL for that purpose.

Regards,

Regards, 

[cardosocristian]

I come from the Juniper world, where I can apply firewall filters, like acl's on the router's loopback that can filter source IP's for the services I want to allow access to, there is something similar in Cisco or the most common is to use ACL's on interfaces directly ?

[Harold Ritter]

Hi @cardosocristian ,

> something similar in Cisco or the most common is to use ACL's on interfaces directly

Yes, configuring the ACL directly on the physical interface would be the recommend approach.

Regards,

[MHM Cisco World]

I fast try use ACL under LO and it not work.

So for LO I think you have one option which is use CoPP

MHM

[Harold Ritter · Accepted solution]

Hi @MHM Cisco World ,

ACLs can't be applied at the loopback interface level. This definitely needs to be done at the physical interface level.

Regards,