what does the default CoPP in 3850 use for?

[tianwen.zhao]

Hello everyone,

Here are the conf:

!

control-plane

 service-policy input system-cpp-policy

!

policy-map system-cpp-policy

 class system-cpp-police-data

  police rate 200 pps

 class system-cpp-police-routing-control

  police rate 1800 pps

 class system-cpp-police-control-low-priority

 class system-cpp-police-wireless-priority1

 class system-cpp-police-wireless-priority2

 class system-cpp-police-wireless-priority3-4-5

!

class-map match-any system-cpp-police-data

  description ICMP redirect, ICMP_GEN and BROADCAST

!

class-map match-any system-cpp-police-routing-control

  description Routing control

!

There is only the description in class-map ,and I can't see any ACL?

So, What does this CoPP use for ?

Thanks

[Reza Sharifi · Accepted solution]

Hi,

There is no ACL in CoPP. It is there to protect the route processor. From Copp document:

• Control Plane Policing (CoPP) – CoPP is the Cisco IOS-wide route processor protection mechanism. As illustrated in Figure 2, and similar to rACLs, CoPP is deployed once to the punt path of the router. However, unlike rACLs that only apply to receive destination IP packets, CoPP applies to all packets that punt to the route processor for handling. CoPP therefore covers not only receive destination IP packets, it also exceptions IP packets and non-IP packets. In addition, CoPP is implemented using the Modular QoS CLI (MQC) framework for policy construction. In this way, in addition to simply permit and deny functions, specific packets may be permitted but rate-limited. This behavior substantially improves the ability to define an effective CoPP policy. (Note: that “Control Plane Policing” is something of a misnomer because CoPP generally protects the punt path to the route processor and not solely the control plane.)
• Link
• https://www.cisco.com/c/en/us/about/security-center/copp-best-practices.html
• HTH