CoPP on network !

[kthned]

Hi,

I need some guide from you on configuring CoPP Control Plane Policing. Though this document define some good understanding on CoPP

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6642/prod_white_paper0900aecd804fa16a.html

The feature basically allow critical traffic (bgp, ospf, snmp etc) to reach Route Processor/control plan. We can either deny, permit or police the traffic in front of RP.

1. My question is how can I find out the rate (pps) of critcal traffic that I need to police. Is there any command that gives me the average pps of protocol hitting RP ?

2. In a medium size network, what is the timeline to implement it. Please share your experience.

Looking forward to your useful answer !

Thanks !

Regards,

Umair

[mlund]

Hi Umair

1, Do it the way the document suggest, it says.

The following example illustrates the configuration of the actual CPP service policy. In this base case, all actions are transmit actions. The only exception is for traffic defined as undesirable, which is unconditionally dropped, regardless of rate and the default class that is rate limited above the specified packets per second (PPS) rate. Configuring the CPP policy using only transmit actions initially without the drop action allows the ability to monitor the classes under normal operating conditions in order to determine the appropriate rate limit. Once the appropriate rate under normal conditions is determined, this information can be used to tighten the policy down by dropping packets that exceed the normal operation rates.

You use "sho policy-map control-plane" to look at the statistic.

2. When I did it it took a couple of weeks to find out decsent values for the different classess.

[kthned]

Thanks for your useful answer. A bit confuse on the netflow to monitor

I wonder Netflow feature to use for monitoring purpose. is it possible to use Netflow feature to find out the frequency of packets all punted packets.

Or Netflow gives information of all the packets (including non-punted), while sh policy-map control-plan gives information only for punted packets. Am I right ?