Cisco Catalyst 4500 Series Software Configuration Guide

57-2
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 57 Configuring Control Plane Policing and Layer 2 Control Packet QoS
Configuring Control Plane Policing
Configuring Control Plane Policing
This section includes these topics:
• About Control Plane Policing, page 57-2
• General Guidelines for Control Plane Policing, page 57-4
• Default Configuration, page 57-4
• Configuring CoPP for Control Plane Traffic, page 57-5
• Configuring CoPP for Data Plane and Management Plane Traffic, page 57-6
• Control Plane Policing Configuration Guidelines and Restrictions, page 57-9
• Policing IPv6 Control Traffic, page 57-20
About Control Plane Policing
Note Catalyst 4500 switch support hardware CoPP for all IPv6 First Hop Security Features (DHCPv6
Inspection/Guard, DHCPv6 remote-ID option for Layer 2, IPv6 full RA Guard, ...) However, due to
inability of VFE to match ICMP v6 packets for policing in the outward direction, hardware CoPP does
not work on Supervisor 6-E, Supervisor 6L-E, Catalyst 4900M, and Catalyst 4948-E. Because “wireless”
is supported only in Supervisor 8-E, wireless related CoPP will work only on Supervisor 8-E in wireless
mode.
The control plane policing (CoPP) feature increases security on the Catalyst 4500 series switch by
protecting the CPU from unnecessary or DoS traffic and giving priority to important control plane and
management traffic. The classification TCAM and QoS policers provide CoPP hardware support.
Traffic managed by the CPU is divided into three functional components or planes:
• Data plane
• Management plane
• Control plane
You can use CoPP to protect most of CPU-bound traffic and to ensure routing stability, reachability, and
packet delivery. Most importantly, you can use CoPP to protect the CPU from a DoS attack.
By default, you receive a list of predefined ACLs matching a selected set of Layer 2 and Layer 3 control
plane packets. You can further define your preferred policing parameters for each of these packets and
modify the matching criteria of these ACLs.
The following table lists the predefined ACLs.
Predefined Named ACL Description
system-cpp-dot1x MAC DA = 0180.C200.0003
system-cpp-lldp MAC DA = 0180.C200.000E
system-cpp-mcast-cfm MAC DA = 0100.0CCC.CCC0 - 0100.0CCC.CCC7
system-cpp-ucast-cfm MAC DA = 0100.0CCC.CCC0
system-cpp-bpdu-range MAC DA = 0180.C200.0000 - 0180.C200.000F

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E