Re: Cisco 3650: Cannot remove class-maps and system-cpp-policy policy-maps

thulandimuthu · ‎04-05-2018

I tried to remove system-cpp-policy class-maps and policy-maps from the cisco 3650 switch. And also AutoQos-4.0-wlan ACLs. But they didn't remove.

Getting following errors.:

% Class-map system-cpp-police-topology-control is being used

System cpp policy can not be removed from control-plane interface

And when ACLs can be removed. But after a reboot again they appear.

ip access-list extended AutoQos-4.0-wlan-Acl-Bulk-Data
 permit tcp any any eq 22
 permit tcp any any eq 465
 permit tcp any any eq 143
 permit tcp any any eq 993
 permit tcp any any eq 995
 permit tcp any any eq 1914
 permit tcp any any eq ftp
 permit tcp any any eq ftp-data
 permit tcp any any eq smtp
 permit tcp any any eq pop3
ip access-list extended AutoQos-4.0-wlan-Acl-MultiEnhanced-Conf
 permit udp any any range 16384 32767
 permit tcp any any range 50000 59999
ip access-list extended AutoQos-4.0-wlan-Acl-Scavanger
 permit tcp any any range 2300 2400
 permit udp any any range 2300 2400
 permit tcp any any range 6881 6999
 permit tcp any any range 28800 29100
 permit tcp any any eq 1214
 permit udp any any eq 1214
 permit tcp any any eq 3689
 permit udp any any eq 3689
 permit tcp any any eq 11999
ip access-list extended AutoQos-4.0-wlan-Acl-Signaling
 permit tcp any any range 2000 2002
 permit tcp any any range 5060 5061
 permit udp any any range 5060 5061
ip access-list extended AutoQos-4.0-wlan-Acl-Transactional-Data
 permit tcp any any eq 443
 permit tcp any any eq 1521
 permit udp any any eq 1521
 permit tcp any any eq 1526
 permit udp any any eq 1526
 permit tcp any any eq 1575
 permit udp any any eq 1575
 permit tcp any any eq 1630
 permit udp any any eq 1630
 permit tcp any any eq 1527
 permit tcp any any eq 6200
 permit tcp any any eq 3389
 permit tcp any any eq 5985
 permit tcp any any eq 8080

I need to remove all those configurations. Can anyone help?

jhalldn · ‎04-05-2018

+1
It seems to be a problem to remove the policy from control-plane. Can't find any information if this is an unremovable thing or if it should be possible to remove. The "no service-policy input system-cpp-policy" takes as command under "control-plane", but the policy is still activated and present. For the moment it can not be removed.
Denali 16.3.x

thulandimuthu · ‎04-05-2018

Thank you for answering.

Yes.

So, what is the suggestion? Is it OK to use with all those class-maps. policy-maps and ACLs?

ACLs will not effect until apply them. But what about that policy applied to control-plane? Will it be a problem?

jhalldn · ‎04-05-2018

As you can see in my reply – i also have this issue (+1) and is looking for some answers.

All this rows (policy-map, class-map and acls) is protection for your box and it's cpu. It's protection for traffic that hit the cpu and need cpu decisions. I guess Cisco have done this as default settings in C3650 and i heard some guys taking about this for all other catalyst products. I really don't know. You could guess that some boxes has run hard with high cpu and this is a fix on just the platform. I think CoPP is something you should look in to in the future and apply on all boxes in your network. Notice though, that rollout would be planned for many months solution, so it is tailor-made for your environment.

So, my best guess and suggestion is to let the CoPP by as default. Set your sdm profile as preferred, disable all wlan stuff if you don't use it. There are some threads in the forum about tweaking some policing in the CoPP-policy-map. That will only apply if you have traffic that is affected. If you know that some of the things the CoPP is configured for and you don't use it och want to disable it, you can only decrease its values, not disable it.

thulandimuthu · ‎04-05-2018

Thanks for the idea and suggestion.

So I guess these things are in-built with the iOS.

Hope these things won't affect the network traffic.

I found how to disable this CPU Queues, in this doc.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/16-1/configuration_guide/b_161_consolidated_3650_cg/b_161_consolidated_3650_cg_chapter_010001101.pdf

But I am not sure how this works.

Any way, there is one thing, I removed the police rate values from the policy-map

policy-map system-cpp-policy
 class system-cpp-police-data
  police rate 200 pps
.
.
.

I used,

no police rate 200 pps

etc.

Then all the police rate values gone. And they didn't appear after reboot. I think that now it will use default values.

Anyway, I guess I have to test the box in with different types of traffics.

jhalldn · ‎04-05-2018

Seems like you found a reasonable fix. Happy hacking!