Control Plane Policing CoPP

Control plane attacks are growing, so protecting the network infrastructure against these types of attacks is imminently required. Control plane policing (CoPP), a Cisco IOS feature that has been available since IOS release 12.2(18)S, allows you to configure a QoS filter that manages the traffic flow of control plane packets. Using CoPP, you can protect the control plane of Cisco IOS routers and switches against DoS and reconnaissance attacks and ensure network stability (router/switch stability in particular) during an attack. Deploying CoPP is a recommended best practice and a key protection mechanism.

The route processor routes and forwards the majority of the traffic that enters a router; the destination of this type of traffic, called data plane traffic, is elsewhere other than the router itself. On the other hand, some traffic—such as routing updates, management traffic, keepalives, and so on—is indeed for the router; this type of traffic is called control and management plane traffic. Formally, the Cisco router functional planes are enlisted as data plane, management plane, control plane, and service plane. Excessive and malicious traffic in the form of control and management traffic aimed at the route processor can have the following devastating results:

■ High or close to 100 percent utilization of CPU or other resources such as memory and buffers

■ Loss of routing updates and keepalives, resulting in route flaps and erroneous NLRI (network layer reachability information) withdrawals and updates

■ Slow response times and interactive sessions, including command-line interface (CLI) through virtual terminal lines

■ Queue buildups, resulting in excessive delays and tail drops, or drops due to lack of buffer space

CoPP mitigates control plane attacks and ensures stability and availability of the routers and switches. CoPP is configured by applying a policy map to the control plane from the control plane configuration mode. In other words, CoPP is applied using modular QoS command-line interface (MQC), providing filtering and rate-limiting for control plane packets. Those devices with route processors on line card modules can be protected by distributed CoPP or control plane configuration mode on the particular slot number. The four steps to configure CoPP are as follows:

Step 1 Define a packet classification criteria. (Use MQC class-map.)

Step 2 Define a service policy. (Use MQC policy-map.)

Step 3 Enter control plane configuration mode.

Step 4 Apply a QoS policy.

Example 6-2 shows a configuration that allows two trusted hosts with source addresses 10.1.1.1 and 10.1.1.2 to forward Telnet packets to the control plane without constraint, while policing all remaining Telnet packets to the control plane at the specified rate. The access list matches all Telnet traffic except that from hosts 10.1.1.1 and 10.1.1.2. The class map telnet-class is defined for all traffic matching access list 100. The policy map telnet-policy applies the police command to the traffic matching class telnet-class. Finally, the telnet-policy is applied to the control plane using the service-policy command. The QoS policy shown in Example 6-2 is applied for aggregate CP services to all packets that are entering the control plane from all line cards in the router.

Example 6-2 CoPP Example: QoS Policy Applied for Aggregate CP Services

class-map telnet-class match access-group 100 !
policy-map telnet-policy class telnet-class police 80000 conform transmit exceed drop !
control-plane
service-policy input telnet-policy !
access-list 100 deny tcp host 10.1.1.1 any eq access-list 100 deny tcp host 10.1.1.2 any eq access-list 100 permit tcp any any eq telnet !	telnet telnet

Example 6-3 shows a similar example, but for distributed CP services, allowing two trusted hosts with source addresses 10.1.1.1 and 10.1.1.2 to forward Telnet packets to the control plane without constraint, while policing all remaining Telnet packets that enter through slot 1 at the specified rate.

Example 6-3 CoPP Example: QoS Policy Applied for Distributed CP Services

class-map telnet-class match access-group 100 !
policy-map telnet-policy class telnet-class police 80000 conform transmit exceed drop !
control-plane slot 1
service-policy input telnet-policy !
access-list 100 deny tcp host 10.1.1.1 any eq access-list 100 deny tcp host 10.1.1.2 any eq access-list 100 permit tcp any any eq telnet !	telnet telnet

Continue reading here: The Need for Wireless LAN QoS

Was this article helpful?

0 -1