Cisco Catalyst 4500 Series - Configuring Control Plane Policing

51-2
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 51 Configuring Control Plane Policing and Layer 2 Control Packet QoS
Configuring Control Plane Policing
Configuring Control Plane Policing
This section includes these topics:
• About Control Plane Policing, page 51-2
• General Guidelines for Control Plane Policing, page 51-3
• Default Configuration, page 51-4
• Configuring CoPP for Control Plane Traffic, page 51-4
• Configuring CoPP for Data Plane and Management Plane Traffic, page 51-5
• Control Plane Policing Configuration Guidelines and Restrictions, page 51-8
• Policing IPv6 Control Traffic, page 51-16
About Control Plane Policing
Note Catalyst 4500 switch support hardware CoPP for all IPv6 First Hop Security Features (DHCPv6
Inspection/Guard, DHCPv6 remote-ID option for Layer 2, IPv6 full RA Guard, ...) However, due to
inability of VFE to match ICMP v6 packets for policing in the outward direction, hardware CoPP does
not work on Supervisor 6-E, Supervisor 6L-E, Catalyst 4900M, and Catalyst 4948-E
The control plane policing (CoPP) feature increases security on the Catalyst 4500 series switch by
protecting the CPU from unnecessary or DoS traffic and giving priority to important control plane and
management traffic. The classification TCAM and QoS policers provide CoPP hardware support.
Traffic managed by the CPU is divided into three functional components or planes:
• Data plane
• Management plane
• Control plane
You can use CoPP to protect most of CPU-bound traffic and to ensure routing stability, reachability, and
packet delivery. Most importantly, you can use CoPP to protect the CPU from a DoS attack.
By default, you receive a list of predefined ACLs matching a selected set of Layer 2 and Layer 3 control
plane packets. You can further define your preferred policing parameters for each of these packets and
modify the matching criteria of these ACLs.
The following table lists the predefined ACLs.
Predefined Named ACL Description
system-cpp-dot1x MAC DA = 0180.C200.0003
system-cpp-lldp MAC DA = 0180.C200.000E
system-cpp-mcast-cfm MAC DA = 0100.0CCC.CCC0 - 0100.0CCC.CCC7
system-cpp-ucast-cfm MAC DA = 0100.0CCC.CCC0
system-cpp-bpdu-range MAC DA = 0180.C200.0000 - 0180.C200.000F
system-cpp-cdp MAC DA = 0100.0CCC.CCCC (UDLD/DTP/VTP/Pagp)
system-cpp-sstp MAC DA = 0100.0CCC.CCCD