Hello,
I am trying to implement control plane policies on my test equipment, my cto is asking me to limit the ICMP max rate for all untrusted addresses. (I have to create an exception for knows hosts)
Having very little experience in CoPP, I believed that I could just Deny some hosts in the ACL so those wont match the rate limit class-map like this :
ip access-list extended ICMP
deny icmp host 192.168.1.3 any
permit icmp any any
My big problem is that ICMP-echoes are incrementing counters of the rate-limit class when sent from the denied host's address. I thought that denying a host in the ACL was going to prevent those echoes from matching this class. (It does with a bunch of other models that I tested and echoes are matching the default-class instead)
The point is that I wanted to add a second ACL to treat those trusted hosts in a different class, but given the fact that the first one is not working, I came here instead to prevent from making mistakes.
Could you tell me if more efficient solutions exists for this case of use ? Have you ever seen this kind of ACL behavior on 1000 series ?
class-map match-any ICMP
match access-group name ICMP
policy-map COPP
class ICMP
police cir 8000
conform-action transmit
exceed-action drop
violate-action drop
ASR1001# show policy-map control-plane
Control Plane
Service-policy input: COPP
Class-map: ICMP (match-any)
720 packets, 50240 bytes ===> Ping from .1.3 are incrementing this counter
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: access-group name ICMP
police:
cir 500000 bps, bc 15625 bytes, be 15625 bytes
conformed 720 packets, 50240 bytes; actions:
transmit
exceeded 0 packets, 0 bytes; actions:
drop
violated 0 packets, 0 bytes; actions:
drop
conformed 0000 bps, exceeded 0000 bps, violated 0000 bps
Class-map: FRAGMENTS (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps
Match: access-group name FRAGMENTS
Class-map: class-default (match-any)
34410 packets, 2052766 bytes
5 minute offered rate 9000 bps, drop rate 0000 bps
