Configuring the Control Plane Policing feature on your Cisco router or switch provides the following benefits:

• Protection against DoS attacks at infrastructure routers and switches
• QoS control for packets that are destined to the control plane of Cisco routers or switches
• Ease of configuration for control plane policies
• Better platform reliability and availability

On the Cisco ASR 1000 series router, the following terms are used for the Control Plane Policing feature.

• Control plane (CP)--A collection of processes that run at the process level on the Route Processor (RP). These processes collectively provide high-level control for most Cisco IOS XE functions. The traffic sent to or sent by the control plane is called control traffic.
• Forwarding plane (FP)--A device that is responsible for high-speed forwarding of IP packets. Its logic is kept simple so that it can be implemented by hardware to do fast packet-forwarding. It punts packets that require complex processing (for example, packets with IP options) to the RP for the control-plane to process them.

To protect the CP on a router from DoS attacks and to provide fine-control over the traffic to or from the CP, the Control Plane Policing feature treats the CP as a separate entity with its own interface for ingress (input) and egress (output) traffic. This interface is called the punt/inject interface, and it is similar to a physical interface on the router. Along this interface, packets are punted from the FP to the RP (in the input direction) and injected from the RP to the FP (in the output direction). A set of quality of service (QoS) rules can be applied on this interface in order to achieve CoPP.

These QoS rules are applied only after the packet has been determined to have the CP as its destination or when a packet exits from the CP. You can configure a service policy (QoS policy map) to prevent unwanted packets from progressing after a specified rate limit has been reached; for example, a system administrator can limit all TCP/SYN packets that are destined for the CP to a maximum rate of 1 megabit per second.

Figure 1

Abstract Illustration of a Cisco ASR 1000 Series Router with Dual RPs and Dual FPs

The figure below provides an abstract illustration of a Cisco ASR 1000 series router with dual RPs and dual FPs. Only one RP and one FP are active at any time. The other RP and FP are in stand-by mode and do not receive traffic from the carrier card (CC). Packets destined to the CP come in through the carrier card, and then go through the active FP before being punted to the active RP. When an input QoS policy map is configured on the CP, the active FP performs the QoS action (for example, a transmit, drop, or set action) before punting packets to the active RP, in order to achieve the best protection of the control-plane in the active RP.

On the other hand, packets exiting the CP are injected to the active FP, and then go out through the carrier card. When an output QoS policy map is configured on the CP, the active FP performs the QoS action after receiving the injected packets from the RP. Again this saves the valuable CPU resource in the RP.

Note	As shown in Control Plane Policing Overview, the management interface is directly connected to the RP, so all traffic through the management interface to or from the control-plane is not subject to the CoPP function performed by the FP.

In high-availability (HA) mode, when an RP switchover happens, the active FP forwards traffic to the new active RP along the new punt/inject interface. The active FP continues to perform the CoPP function before punting traffic to the new active RP. When an FP switchover happens, the new active FP receives traffic from the carrier card, and performs the CoPP function before punting traffic to the active RP.

Note

The Cisco ASR 1000 series router handles some traditional control traffic in the FP directly to reduce the load on the CP. One example is the IP Internet Control Message Protocol (ICMP) echo-request packet sent to this router. When a Cisco ASR1000 series router receives such packets, the packets are handled directly in the FP without being punted to the RP. In order to be consistent with other Cisco routers and to provide the same capability to control such packets using CoPP, the Cisco ASR 1000 series router extends the CoPP function on such packets, even though the packets are not punted to the RP. Customers can still use the CoPP function to rate-limit or to mark such packets.

A router is automatically enabled to silently discard packets when you configure output policing on control plane traffic using the service-policy output policy-map-name command.

Rate-limiting (policing) of output traffic from the CP is performed in silent mode. In silent mode, a router that is running Cisco IOS XE software operates without sending any system messages. If a packet that is exiting the control plane is discarded for output policing, you do not receive an error message.

Before You Begin

Before you enter control-plane configuration mode to attach an existing QoS policy to the control plane, you must first create the policy using MQC to define a class map and policy map for control plane traffic.

Note	Platform-specific restrictions, if any, are checked when the service policy is applied to the control plane interface. Output policing does not provide any performance benefits. It simply controls the information that is leaving the device. >

1.    enable

2.    configure terminal

3.    control-plane

4.    service-policy {input| output policy-map-name

5.    end

1.    enable

2.    show policy-map control-plane [all] [input [class class-name] | output [class class-name]]

3.    exit

Router# show policy-map control-plane
 
Control Plane 
Service-policy input:TEST
Class-map:TEST (match-all)
      20 packets, 11280 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match:access-group 101
      police:
        8000 bps, 1500 limit, 1500 extended limit
        conformed 15 packets, 6210 bytes; action:transmit
        exceeded 5 packets, 5070 bytes; action:drop
        violated 0 packets, 0 bytes; action:drop
        conformed 0 bps, exceed 0 bps, violate 0 bps
Class-map:class-default (match-any)
      105325 packets, 11415151 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match:any