Control Plane Policing
Available Languages
Table Of Contents
Prerequisites for Control Plane Policing
Restrictions for Control Plane Policing
Information About Control Plane Policing
Benefits of Control Plane Policing
Control Plane Security and Packet QoS Overview
Aggregate Control Plane Services
Distributed Control Plane Services
Output Rate-Limiting and Silent Mode Operation
How to Use the Control Plane Policing Feature
Defining Aggregate Control Plane Services
Defining Distributed Control Plane Services
Verifying Aggregate CP Services
Verifying Distributed CP Services
Configuration Examples for Control Plane Policing
Configuring Control Plane Policing on Input Telnet Traffic: Example
Configuring Control Plane Policing on Output Telnet Traffic: Example
Configuring Control Plane Policing on Input Distributed CP Traffic: Example
service-policy (control-plane)
Feature Information for Control Plane Policing
Control Plane Policing
Last Updated: November, 2006
The Control Plane Policing feature allows users to configure a quality of service (QoS) filter that manages the traffic flow of control plane packets to protect the control plane of Cisco IOS routers and switches against reconnaissance and denial-of-service (DoS) attacks. In this way, the control plane (CP) can help maintain packet forwarding and protocol states despite an attack or heavy traffic load on the router or switch.
Finding Feature Information in This Module
Your Cisco IOS software release may not support all of the features documented in this module. To reach links to specific feature documentation in this module and to see a list of the releases in which each feature is supported, use the "Feature Information for Control Plane Policing" section on page 34.
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Prerequisites for Control Plane Policing
•
•
•
•
Prerequisites for Control Plane Policing
•
For information about Cisco IOS QoS and the procedure for configuring QoS in your network using the modular QoS command-line interface (MQC), refer to Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.3 and Cisco 10000 Series Router Quality of Service Configuration Guide.
Restrictions for Control Plane Policing
Aggregate and Distributed Control Plane Policing
Aggregate policing is supported in Cisco IOS Release 12.0(29)S, Cisco IOS Release 12.2(18)S, and Cisco IOS Release 12.3(4)T and later releases.
Distributed policing is supported only in Cisco IOS Release 12.0(30)S and later Cisco IOS 12.0S releases.
Output Rate-Limiting Support
Output rate-limiting is performed in silent (packet discard) mode. Silent mode enables a router to silently discard packets using policy maps applied to output control plane traffic with the service-policy output command. For more information, see Output Rate-Limiting and Silent Mode Operation.
Output rate-limiting (policing) in silent mode is supported only in:
•
•
Output rate-limiting is not supported for distributed control plane services in Cisco IOS 12.0S releases or in Cisco IOS 12.2SX releases.
Output rate-limiting is not supported on the Cisco 7500 series, Cisco 10720 Internet router, and Cisco 10000 series router.
Modular QoS Restrictions
The Control Plane Policing feature requires the modular QoS command-line interface (CLI) (MQC) to configure packet classification and policing. All restrictions that apply when you use the MQC to configure policing also apply when you configure control plane policing. Only two MQC actions are supported in policy maps—police and drop.
Features that require network-based application recognition (NBAR) classification may not work well at the control plane level. The following classification (match) criteria are supported on all platforms:
•
•
Note
Cisco 10720 Internet Router
On the Cisco 10720 Internet router, only the police command, not the drop command, is supported in policy maps. In addition, in a QoS service policy attached to the 10720 control plane, the police command does not support set actions as arguments in conform-action, exceed-action, and violate-action parameters.
The following MQC commands are supported in class-map configuration mode: match input-interface, match mpls experimental, match protocol ipv6, and match qos-group. When using these commands for control plane policing on the Cisco 10720 Internet router, note the following restrictions:
•
•
–
–
–
–
–
–
Packets that are not supported for QoS packet classification on the Cisco 10720 Internet router are not policed in the default traffic class for control plane policing.
Cisco 10000 Series Router
In Cisco IOS Release 12.2(31)SB2, the Control Plane Policing feature is introduced on the Cisco 10000 series router. It supports traffic policing on the basis of packets per second (pps), as well as all other existing police operations for control plane traffic. The Cisco 10000 series router supports Parallel Express Forwarding (PXF) aggregate control plane policing.
The following MQC commands are supported in class-map configuration mode: match input-interface, match protocol ipv6, match qos-group, match mpls experimental, and match protocol arp. When using these commands for control plane policing, packet classification using match criteria is not supported for packets that cannot be classified in the data path, such as unknown Layer 2 encapsulation and IP options.
Packets that are not supported for QoS packet classification are not policed in the default traffic class for control plane policing.
CISCO-CLASS-BASED-QOS-MIB Control Plane Support
In Cisco IOS Release 12.3(7)T and later Cisco IOS 12.3T releases, the CISCO-CLASS-BASED-QOS-MIB is extended to manage control plane QoS policies and provide information about the control plane.
Cisco IOS Release 12.2(18)SXD1
In Cisco IOS Release 12.2(18)SXD1 and later releases, Hardware Control Plane Interface for Control Plane Policing has the following restrictions:
•
•
•
•
Cisco IOS Release 12.2(31)SB2
Control Plane Policing has the following restrictions on the Cisco 10000 series router:
•
•
•
•
For more information about Control Plane Policing in Cisco IOS Release 12.2(18)SXD1 and later releases, see these publications:
•
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/122sx/swcg/dos.htm
•
http://www.cisco.com/univercd/cc/td/doc/product/core/cis7600/software/122sx/swcg/dos.htm
Information About Control Plane Policing
To configure the Control Plane Policing feature, you should understand the following concepts:
•
•
•
•
•
•
Benefits of Control Plane Policing
Configuring the Control Plane Policing feature on your Cisco router or switch provides the following benefits:
•
•
•
•
Terms to Understand
Because different platforms can have different architectures, the following set of terms is defined. Figure 1 illustrates how control plane policing works.
Figure 1 Layout of Control Plane, Central Switch Engine, Distributed Switch Engines, and Line Cards on a Router
•
•
Note
On the Cisco 10720 Internet router and the Cisco 10000 series router, control plane policing is implemented on Cisco Parallel eXpress Forwarding (PXF) in a Toaster-based architecture. PXF is a hardware-based central switch engine that can filter traffic at a higher rate than the route processor. PXF switches all data traffic separately from the route processor. PXF packet processing occurs at an intermediate step between the nondistributed line cards and route processor shown in Figure 1. In addition to the regular punting, PXF also punts certain types of packets (such as unknown Layer 2 encapsulation and packets with IP options) to the RP for further processing at interrupt level.
For more information, refer to Queueing Architecture and Modular Quality of Service (QoS) on the Cisco 10720 Internet Router and Cisco 10000 Series Router Quality of Service Configuration Guide..
Note
•
•
Note
Control Plane Security and Packet QoS Overview
To protect the CP on a router from DoS attacks and to provide packet QoS, the Control Plane Policing feature treats the CP as a separate entity with its own ingress (input) and egress (output) ports, which are like ports on a router and switch. Because the Control Plane Policing feature treats the CP as a separate entity, a set of rules can be established and associated with the ingress and egress port of the CP.
These rules are applied only after the packet has been determined to have the CP as its destination or when a packet exits from the CP. Thereafter, you can configure a service policy to prevent unwanted packets from progressing after a specified rate limit has been reached; for example, a system administrator can limit all TCP/SYN packets that are destined for the CP to a maximum rate of 1 megabit per second.
Input CP services are executed after router input port services and a routing decision on the input path have been made. As shown in Figure 2, CP security and packet QoS are applied on:
•
•
Figure 2 Input Control Plane Services: Aggregate and Distributed Services
The following types of Layer 3 packets are forwarded to the control plane and processed by aggregate and distributed control plane policing:
•
•
•
Note
Aggregate Control Plane Services
Aggregate control plane services provide control plane policing for all CP packets received from all line-card interfaces on the router.
The central switch engine executes normal input port services and makes routing decisions for an incoming packet: if the packet is destined for the CP, aggregate services are performed. Because CP traffic from all line cards must pass through aggregate CP services, these services manage the cumulative amount of CP traffic that reaches the CP.
Aggregate CP service steps are as follows:
1.
Note
2.
3.
4.
5.
Functionality Highlights of Aggregate CP Services
The following list highlights the functionality of aggregate CP services:
•
•
•
Distributed Control Plane Services
Distributed control plane services provide control plane policing for all CP packets received from the interfaces on a line card.
A distributed switch engine executes normal input port services and makes routing decisions for a packet: if the packet is destined for the CP, distributed CP services are performed. Afterwards, CP traffic from each line card is forwarded to the central switch engine where aggregate CP services are applied.
Note
Distributed CP service steps are as follows:
1.
2.
3.
4.
5.
6.
Functionality Highlights of Distributed CP Services
The following list highlights the functionality of distributed CP services:
•
•
•
Distributed CP services allow you to limit the number of CP packets forwarded from a line card to the central switch engine. The total amount of CP packets received from all line cards on a router may exceed aggregate CP levels.
Using Distributed CP Services
The purpose of CP protection and packet QoS is to apply sufficient control to the packets that reach the control plane. To successfully configure this level of CP protection, you must:
•
•
Distributed CP services allow you to configure specific CP services that are enforced at the line card level and required for the following reasons:
•
•
•
•
Output Rate-Limiting and Silent Mode Operation
A router is automatically enabled to silently discard packets when you configure output policing on control plane traffic, using the service-policy output policy-map-name command.
Rate-limiting (policing) of output traffic from the CP is performed in silent mode. In silent mode, a router that is running Cisco IOS software operates without sending any system messages. If a packet that is exiting from the control plane is discarded for output policing, you do not receive an error message.
When control plane policing is configured for output traffic, error messages are not generated in the following cases:
•
•
Note
- Cisco IOS Release 12.2(25)S and later Cisco IOS 12.2S releases.
- Cisco IOS Release 12.3(4)T and later Cisco IOS 12.3T releases.
Silent mode and output policing on CP traffic are not supported for distributed control plane services.
How to Use the Control Plane Policing Feature
This section documents the following procedures:
•
•
•
•
Defining Aggregate Control Plane Services
Perform this task to configure aggregate CP services, such as packet rate control and silent packet discard, for the active route processor.
Prerequisites
Before you enter control-plane configuration mode to attach an existing QoS policy to the control plane, you must first create the policy using MQC to define a class map and policy map for control plane traffic.
For information about how to classify traffic and create a QoS policy, refer to the "Modular Quality of Service Command-Line Interface" chapter in the Cisco IOS Quality of Service Solutions Configuration Guide and the Cisco 10000 Series Router Quality of Service Configuration Guide.
Restrictions
•
•
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Defining Distributed Control Plane Services
Perform this task to configure distributed control plane services, such as packet rate control, for packets that are destined for the control plane and sent from the interfaces on a line card.
Prerequisites
Before you enter control-plane configuration mode to attach an existing QoS policy for performing distributed control-plane services, you must first create the policy using MQC to define a class map and policy map for control-plane traffic.
For information about how to classify traffic and create a QoS policy, refer to the "Modular Quality of Service Command-Line Interface" chapter in the Cisco IOS Quality of Service Solutions Configuration Guide and the Cisco 10000 Series Router Quality of Service Configuration Guide.
Restrictions
•
•
•
•
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Verifying Aggregate CP Services
To display information about the service policy attached to the control plane for aggregate CP services, perform the following optional steps.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Examples
The following example shows that the policy map TEST is associated with the control plane. This policy map polices traffic that matches the class map TEST, while allowing all other traffic (that matches the class map "class-default") to go through as is. Table 2 describes the significant fields in the display.
Router# show policy-map control-planeControl PlaneService-policy input:TESTClass-map:TEST (match-all)20 packets, 11280 bytes5 minute offered rate 0 bps, drop rate 0 bpsMatch:access-group 101police:8000 bps, 1500 limit, 1500 extended limitconformed 15 packets, 6210 bytes; action:transmitexceeded 5 packets, 5070 bytes; action:dropviolated 0 packets, 0 bytes; action:dropconformed 0 bps, exceed 0 bps, violate 0 bpsClass-map:class-default (match-any)105325 packets, 11415151 bytes5 minute offered rate 0 bps, drop rate 0 bpsMatch:anyVerifying Distributed CP Services
To display information about the service policy attached to the control plane to perform distributed CP services, perform the following optional steps.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Examples
The following example shows how to display information about the classes of CP traffic received from all interfaces on the line card in slot 1 to which the policy map TESTII is applied for distributed CP services. This policy map polices traffic that matches the traffic class TESTII, while allowing all other traffic (that matches the class map "class-default") to go through as is. (Table 2 describes the significant fields shown in the display.)
Router# show policy-map control-plane slot 1Control Plane - slot 1Service-policy input: TESTII (1048)Class-map: TESTII (match-all) (1049/4)0 packets, 0 bytes5 minute offered rate 0 bps, drop rate 0 bpsMatch: protocol arp (1050)police:cir 8000 bps, bc 4470 bytes, be 4470 bytesconformed 0 packets, 0 bytes; actions:transmitexceeded 0 packets, 0 bytes; actions:dropviolated 0 packets, 0 bytes; actions:dropconformed 0 bps, exceed 0 bps, violate 0 bpsClass-map: class-default (match-any) (1052/0)0 packets, 0 bytes5 minute offered rate 0 bps, drop rate 0 bpsMatch: any (1053)Configuration Examples for Control Plane Policing
This section contains examples that shows how to configure aggregate control plane services on both an input and an output interface:
•
•
•
Configuring Control Plane Policing on Input Telnet Traffic: Example
The following example shows how to apply a QoS policy for aggregate CP services to Telnet traffic received on the control plane. Trusted hosts with source addresses 10.1.1.1 and 10.1.1.2 forward Telnet packets to the control plane without constraint, while allowing all remaining Telnet packets to be policed at the specified rate:
! Allow 10.1.1.1 trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.1 any eq telnet! Allow10.1.1.2trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.2 any eq telnet! Rate limit all other Telnet traffic.Router(config)# access-list 140 permit tcp any any eq telnet! Define class-map "telnet-class."Router(config)# class-map telnet-classRouter(config-cmap)# match access-group 140Router(config-cmap)# exitRouter(config)# policy-map control-plane-inRouter(config-pmap)# class telnet-classRouter(config-pmap-c)# police 80000 conform transmit exceed dropRouter(config-pmap-c)# exitRouter(config-pmap)# exit! Define aggregate control plane service for the active Route Processor.Router(config)# control-planeRouter(config-cp)# service-policy input control-plane-inRouter(config-cp)# exitConfiguring Control Plane Policing on Output Telnet Traffic: Example
The following example shows how to apply a QoS policy for aggregate CP services to Telnet traffic transmitted from the control plane. Trusted networks with source addresses 3.3.3.0 and 4.4.4.0 receive Internet Control Management Protocol (ICMP) port-unreachable responses without constraint, while allowing all remaining ICMP port-unreachable responses to be dropped:
! Allow 3.3.3.0 trusted network traffic.Router(config)# access-list 141 deny icmp 3.3.3.0 0.0.0.255 any port-unreachable! Allow 4.4.4.0 trusted network traffic.Router(config)# access-list 141 deny icmp 4.4.4.0 0.0.0.255 any port-unreachable! Rate limit all other ICMP traffic.Router(config)# access-list 141 permit icmp any any port-unreachableRouter(config)# class-map icmp-classRouter(config-cmap)# match access-group 141Router(config-cmap)# exitRouter(config)# policy-map control-plane-out! Drop all traffic that matches the class "icmp-class."Router(config-pmap)# class icmp-classRouter(config-pmap-c)# dropRouter(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# control-plane! Define aggregate control plane service for the active route processor.Router(config-cp)# service-policy output control-plane-outRouter(config-cp)# exitConfiguring Control Plane Policing on Input Distributed CP Traffic: Example
The following example shows how to attach a QoS policy to perform distributed CP services on packets destined for the CP from the interfaces on the line card in slot 1.
As in the previous example, trusted hosts are configured with source addresses 10.1.1.1 and 10.1.1.2 to forward Telnet packets to the control plane without constraint, while allowing all remaining Telnet packets that enter through slot 1 to be policed at the specified rate.
! Allow 10.1.1.1 trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.1 any eq telnet! Allow10.1.1.2trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.2 any eq telnet! Rate limit all other Telnet traffic.Router(config)# access-list 140 permit tcp any any eq telnet! Define class-map "telnet-class."Router(config)# class-map telnet-classRouter(config-cmap)# match access-group 140Router(config-cmap)# exitRouter(config)# policy-map control-plane-inRouter(config-pmap)# class telnet-classRouter(config-pmap-c)# police 80000 conform transmit exceed dropRouter(config-pmap-c)# exitRouter(config-pmap)# exit! Define aggregate control plane service for the active Route Processor.Router(config)# control-plane slot 1Router(config-cp)# service-policy input control-plane-inRouter(config-cp)# exitAdditional References
The following sections provide references related to Control Plane Policing.
Related Documents
QoS information and configuration tasks
Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.3
Cisco 10000 Series Router Quality of Service Configuration Guide, Release 12.2(31)SB
Additional QoS commands
Cisco IOS Quality of Service Solutions Command Reference, Release 12.3T
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
RFCs
Technical Assistance
Command Reference
This section documents new and modified commands.
New Commands in Cisco IOS Release 12.2(18)S
•
•
Modified Commands in Cisco IOS Release 12.3(4)T
•
•
New Command in Cisco IOS Release 12.3(7)T
•
Modified Commands in Cisco IOS Release 12.0(30)S
•
•
Modified Command in Cisco IOS Release 12.2(31)SB2
•
•
control-plane
To enter control-plane configuration mode and apply an existing quality of service (QoS) policy to police traffic destined for the control plane, use the control-plane command in global configuration mode. To remove an existing control-plane configuration from the router, use the no form of this command.
Syntax for T Releases
control-plane [host | transit | cef-exception]
no control-plane [host | transit | cef-exception]
Syntax for 12.0 S Releases
control-plane [slot slot-number] [host | transit | cef-exception]
no control-plane [slot slot-number] [host | transit | cef-exception]
Syntax for Cisco 10000 Series Router
control-plane
no control-plane
Syntax Description
Command Default
No control-plane service policies are defined.
Command Modes
Global configuration
Command History
Usage Guidelines
After you enter the control-plane command, you can define aggregate control-plane policing policies for the route processor (RP). You can configure a service policy to police all traffic destined to the control plane:
•
•
Aggregate CP services manage traffic destined for the control plane and received on the central switch engine from all line cards in the router.
Distributed CP services manage CP traffic from interfaces on a specified line card before CP packets are forwarded to the central switch engine where aggregate CP services are applied.
Note
Control-plane policing in this version includes enhanced control-plane functionality. It provides a mechanism for early dropping of packets directed toward closed or nonlistened Cisco IOS TCP/UPD ports on the router. It also provides the ability to limit protocol queue usage such that no single misbehaving protocol process can wedge the control plane interface hold queue.
With this enhancement, you can classify control-plane traffic into different categories of traffic. These categories are as follows:
•
•
•
Cisco 10000 Series Router
The control-plane command has no arguments or keywords. After you issue the control-plane command, you can begin defining aggregate control plane services for the PXF; for example, you can associate a service policy to police all traffic that is destined to the control plane.
Examples
The following example shows how to configure trusted hosts with source addresses 10.1.1.1 and 10.1.1.2 to forward Telnet packets to the control plane without constraint, while allowing all remaining Telnet packets to be policed at the specified rate. The QoS policy is then applied for aggregate CP services to all packets that are entering the control plane from all line cards in the router.
! Allow 10.1.1.1 trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.1 any eq telnet! Allow10.1.1.2trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.2 any eq telnet! Rate limit all other Telnet traffic.Router(config)# access-list 140 permit tcp any any eq telnet! Define class-map "telnet-class."Router(config)# class-map telnet-classRouter(config-cmap)# match access-group 140Router(config-cmap)# exitRouter(config)# policy-map control-plane-inRouter(config-pmap)# class telnet-classRouter(config-pmap-c)# police 80000 conform transmit exceed dropRouter(config-pmap-c)# exitRouter(config-pmap)# exit! Define aggregate control plane service for the active Route Processor.Router(config)# control-planeRouter(config-cp)# service-policy input control-plane-inRouter(config-cp)# exitThe next example also shows how to configure trusted hosts with source addresses 10.1.1.1 and 10.1.1.2 to forward Telnet packets to the control plane without constraint, while allowing all remaining Telnet packets that enter through slot 1 to be policed at the specified rate. The QoS policy is applied for distributed CP services to all packets that enter through the interfaces on the line card in slot 1 and are destined for the control plane.
! Allow 10.1.1.1 trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.1 any eq telnet! Allow10.1.1.2trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.2 any eq telnet! Rate limit all other Telnet traffic.Router(config)# access-list 140 permit tcp any any eq telnet! Define class-map "telnet-class."Router(config)# class-map telnet-classRouter(config-cmap)# match access-group 140Router(config-cmap)# exitRouter(config)# policy-map control-plane-inRouter(config-pmap)# class telnet-classRouter(config-pmap-c)# police 80000 conform transmit exceed dropRouter(config-pmap-c)# exitRouter(config-pmap)# exit! Define aggregate control plane service for the active Route Processor.Router(config)# control-plane slot 1Router(config-cp)# service-policy input control-plane-inRouter(config-cp)# exitThe following shows how to apply an aggregate CoPP policy to the host control-plane traffic by applying it to the host control-plane feature path:
Router(config)# control-plane hostRouter(config-cp)# service-policy input cpp-policy-hostThe following shows how to apply an aggregate CoPP policy to the transit control-plane traffic by applying it to the control-plane transit feature path:
Router(config)# control-plane transitRouter(config-cp)# service-policy input cpp-policy-transitThe following shows how to apply an aggregate CoPP policy to the cef-exception control-plane traffic by applying it to the control-plane CEF-exception feature path:
Router(config)# control-plane unidentifiedRouter(config-cp)# service-policy input cpp-policy-unidentifiedCisco 10000 Series Router
The following example shows how to configure trusted hosts with source addresses 10.1.1.1 and 10.1.1.2 to forward Telnet packets to the control plane without constraint, while allowing all remaining Telnet packets to be policed at the specified rate:
! Allow 10.1.1.1 trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.1 any eq telnet! Allow 10.1.1.2 trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.2 any eq telnet! Rate limit all other Telnet traffic.Router(config)# access-list 140 permit tcp any any eq telnet! Define class-map "telnet-class."Router(config)# class-map telnet-classRouter(config-cmap)# match access-group 140Router(config-cmap)# exitRouter(config)# policy-map control-plane-policyRouter(config-pmap)# class telnet-classRouter(config-pmap-c)# police 80000 conform transmit exceed dropRouter(config-pmap-c)# exitRouter(config-pmap)# exit! Define aggregate control plane service for the active Route Processor.Router(config)# control-planeRouter(config-cp)# service-policy input control-plane-policyRouter(config-cp)# exitRelated Commands
police rate (control-plane)
To configure traffic policing for traffic that is destined for the control plane, use the police rate command in policy-map class configuration mode. To remove traffic policing from the configuration, use the no form of this command.
Syntax for Cisco 10000 Series Router
police rate units pps [burst burst-in-packets packets] [peak-rate peak-rate-in-pps pps] [peak-burst peak-burst-in-packets packets] [conform-action action [exceed-action action] [violate-action action]
no police rate units pps [burst burst-in-packets packets] [peak-rate peak-rate-in-pps pps] [peak-burst peak-burst-in-packets packets] [conform-action action] [exceed-action action] [violate-action action]
Syntax for Packets per Seconds
police rate units pps [burst burst-in-packets packets] [peak-rate peak-rate-in-pps pps] [peak-burst peak-burst-in-packets packets]
no police rate units pps [burst burst-in-packets packets] [peak-rate peak-rate-in-pps pps] [peak-burst peak-burst-in-packets packets]
Syntax for Bytes per Seconds
police rate units bps [burst burst-in-bytes bytes] [peak-rate peak-rate-in-bps bps] [peak-burst peak-burst-in-bytes bytes]
no police rate units bps [burst burst-in-bytes bytes] [peak-rate peak-rate-in-bps bps] [peak-burst peak-burst-in-bytes bytes]
Syntax for Percent
police rate percent percentage [burst ms ms] [peak-rate percent percentage] [peak-burst ms ms]
no police rate percent percentage [burst ms ms] [peak-rate percent percentage] [peak-burst ms ms]
Syntax Description
Defaults
Disabled
Command Modes
Policy-map class configuration
Command History
Usage Guidelines
Use the police rate command to limit traffic that is destined for the control plane on the basis of pps, bps, or a percentage of interface bandwidth. If the police rate command is issued, but the a rate is not specified, traffic that is destined for the control plane is policed on the basis of bits per second (bps).
Cisco 10000 Series Router
Table 1 lists the actions you can specify for the conform-action, exceed-action, and violate-action keywords. You can specify only one action in a command line.
Examples
The following example shows how to configure policing on a class to limit traffic to an average rate of 1,500,000 pps:
Router(config)# class-map telnet-classRouter(config-cmap)# match access-group 140Router(config-cmap)# exitRouter(config)# policy-map control-plane-policyRouter(config-pmap)# class telnet-classRouter(config-pmap-c)# police rate 1500000 pps burst 500000 packetsRouter(config-pmap-c)# exitCisco 10000 Series Router
The following example shows how to configure the action to take on packets that conform to the police rate limit:
Router(config)# access-list 140 deny tcp host 10.1.1.1 any eq telnetRouter(config)# access-list 140 deny tcp host 10.1.1.2 any eq telnetRouter(config)# access-list 140 permit tcp any any eq telnetRouter(config)# class-map match-any pps-1Router(config-cmap)# match access-group 140Router(config-cmap)# exitRouter(config)# policy-map copp-ppsRouter(config-pmap)# class pps-1Router(config-pmap)# police rate 10000 pps burst 100 packets peak-rate 10100 pps peak-burst 150 packets conform-action transmitRouter(config-cmap)# exitRouter(config)# control-planeRouter(config-cp)# service-policy input copp-ppsRouter(config-cp)# exitRelated Commands
service-policy (control-plane)
To attach a policy map to a control plane for aggregate or distributed control plane services, use the service-policy command in control-plane configuration mode. To remove a service policy from a control plane, use the no form of this command.
service-policy {input | output} policy-map-name
no service-policy {input | output} policy-map-name
Syntax for Cisco 6500 Router, Cisco 7500 Series, Cisco 10720 Internet Router, and Cisco 10000 Series Router
service-policy input policy-map-name
no service-policy input policy-map-name
Syntax Description
Command Default
No service policy is specified.
Command Modes
Control-plane configuration
Command History
Usage Guidelines
After entering the control-plane command, use the service-policy command to configure a quality of service (QoS) policy. This policy is attached to the control plane interface for aggregate or distributed control plane services, and controls the number or rate of packets that are going to the process level.
When you configure output policing on control-plane traffic, using the service-policy output policy-map-name command, a router is automatically enabled to silently discard packets. Output policing is supported as follows:
•
–
–
–
•
•
The service-policy output command configures output policing, which is performed in silent mode to silently discard packets exiting from the control plane according to the attached QoS policy. Silent mode allows a router that is running Cisco IOS software to operate without sending any system messages. If a packet that is exiting from the control plane is discarded for output policing, you do not receive an error message.
Silent mode allows a router that is running Cisco IOS software to operate without sending any system messages. If a packet that is destined for the router is discarded for any reason, users will not receive an error message. Some events that will not generate error messages are as follows:
•
•
Examples
The following example shows how to configure trusted hosts with source addresses 10.1.1.1 and 10.1.1.2 to forward Telnet packets to the control plane without constraint, while allowing all remaining Telnet packets to be policed at the specified rate:
! Allow 10.1.1.1 trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.1 any eq telnet! Allow10.1.1.2trusted host traffic.Router(config)# access-list 140 deny tcp host 10.1.1.2 any eq telnet! Rate limit all other Telnet traffic.Router(config)# access-list 140 permit tcp any any eq telnet! Define class-map "telnet-class."Router(config)# class-map telnet-classRouter(config-cmap)# match access-group 140Router(config-cmap)# exitRouter(config)# policy-map control-plane-policyRouter(config-pmap)# class telnet-classRouter(config-pmap-c)# police 80000 conform transmit exceed dropRouter(config-pmap-c)# exitRouter(config-pmap)# exit! Define aggregate control plane service for the active Route Processor.Router(config)# control-planeRouter(config-cp)# service-policy input control-plane-policyRouter(config-cp)# exitThe next example shows how to configure trusted networks with source addresses 10.0.0.0 and 10.0.0.2 to receive Internet Control Message Protocol (ICMP) port-unreachable responses without constraint, while allowing all remaining ICMP port-unreachable to be dropped:
! Allow 10.0.0.0 trusted network traffic.Router(config)# access-list 141 deny icmp host 10.0.0.0 255.255.255.224 any port-unreachable! Allow 10.0.0.2 trusted network traffic.Router(config)# access-list 141 deny icmp host 10.0.0.2 255.255.255.224 any port-unreachable! Rate limit all other ICMP traffic.Router(config)# access-list 141 permit icmp any any port-unreachableRouter(config)# class-map icmp-classRouter(config-cmap)# match access-group 141Router(config-cmap)# exitRouter(config)# policy-map control-plane-out-policy! Drop all traffic that matches the class "icmp-class."Router(config-pmap)# class icmp-classRouter(config-pmap-c)# dropRouter(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# control-plane! Define aggregate control plane service for the active route processor.Router(config-cp)# service-policy output control-plane-out-policyRouter(config-cp)# exitRelated Commands
show policy-map control-plane
To display the configuration and statistics for a traffic class or all traffic classes in the policy maps attached to the control plane for aggregate and distributed control plane policing services, use the show policy-map control-plane command in privileged EXEC mode.
show policy-map control-plane [type policy-type] [all | slot slot-number] [host | transit | cef-exception] [{input | output} [class class-name]]
Syntax Description
Command Default
Information displays for all classes of the policy map of the control plane.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The show policy-map control-plane command displays information for aggregate and distributed control-plane policing services, which manage the number or rate of CP packets sent to the process level of the Route Processor.
Information for distributed control-plane service is displayed for a specified line card. Distributed CP services are performed on a line card's distributed switch engine and manage CP traffic sent from all interfaces on the line card to the route processor, where aggregate CP services (for CP packets received from all line cards on the router) are performed.
Examples
The following example shows that the policy map TEST is associated with the control plane. This policy map polices traffic that matches the class map TEST, while allowing all other traffic (that matches the class map called "class-default") to go through as is. Table 2 describes the significant fields shown in the display.
Router# show policy-map control-planeControl PlaneService-policy input:TESTClass-map:TEST (match-all)20 packets, 11280 bytes5 minute offered rate 0 bps, drop rate 0 bpsMatch:access-group 101police:8000 bps, 1500 limit, 1500 extended limitconformed 15 packets, 6210 bytes; action:transmitexceeded 5 packets, 5070 bytes; action:dropviolated 0 packets, 0 bytes; action:dropconformed 0 bps, exceed 0 bps, violate 0 bpsClass-map:class-default (match-any)105325 packets, 11415151 bytes5 minute offered rate 0 bps, drop rate 0 bpsMatch:any
Table 2 show policy-map control-plane Field Descriptions
Fields Associated with Classes or Service Policies
Service-policy input
Name of the input service policy that is applied to the control plane. (This field will also show the output service policy, if configured.)
Class-map
Class of traffic being displayed. Traffic is displayed for each configured class. The choice for implementing class matches (for example, match-all or match-any) can also appear next to the traffic class.
offered rate
Rate, in kbps, at which packets are coming into the class.
drop rate
Rate, in kbps, at which packets are dropped from the class. The drop rate is calculated by subtracting the number of successfully transmitted packets from the offered rate.
Match
Match criteria for the specified class of traffic.
For more information about the variety of match criteria options available, see the "Configuring the Modular Quality of Service Command-Line Interface" chapter in the Cisco IOS Quality of Service Solutions Configuration Guide.
Fields Associated with Traffic Policing
police
Indicates that the police command has been configured to enable traffic policing.
conformed
Displays the action to be taken on packets that conform to a specified rate. Displays the number of packets and bytes on which the action was taken.
exceeded
Displays the action to be taken on packets that exceed a specified rate. Displays the number of packets and bytes on which the action was taken.
violated
Displays the action to be taken on packets that violate a specified rate. Displays the number of packets and bytes on which the action was taken.
Cisco 10000 Series Router
The following example shows information for all QoS policies attached to the control plane. Table 2 describes the significant fields shown in the display.
Router# show policy-map control-plane allControl PlaneService-policy input: copp_policyClass-map: mfib_224 (match-any)2400000 packets, 340800000 bytes5 minute offered rate 6894000 bps, drop rate 4313000 bpsMatch: ip precedence 22400000 packets, 340800000 bytes5 minute rate 6894000 bpsPolice:rate 5000 pps, 250 limit, peak-rate 7500 pps, 500 extended limitconformed 600245 packets, 85234790 bytes; action: set-qos-transmit 2exceeded 300247 packets, 42635074 bytes; action: transmitviolated 1499508 packets, 212930136 bytes; action: dropClass-map: arp (match-any)1200000 packets, 170400000 bytes5 minute offered rate 3452000 bps, drop rate 2419000 bpsMatch: protocol arp1200000 packets, 170400000 bytes5 minute rate 3452000 bpsPolice:rate 2500 pps, 250 limit, peak-rate 3000 pps, 500 extended limitconformed 300248 packets, 42635216 bytes; action: transmitexceeded 60250 packets, 8555500 bytes; action: transmitviolated 839502 packets, 119209284 bytes; action: dropClass-map: fib_dest (match-any)1200036 packets, 170402704 bytes5 minute offered rate 3452000 bps, drop rate 870000 bpsMatch: not protocol ipv61200036 packets, 170402704 bytes5 minute rate 3452000 bpsPolice:rate 5000 pps, 250 limit, peak-rate 7500 pps, 500 extended limitconformed 600255 packets, 85234909 bytes; action: transmitexceeded 300245 packets, 42634721 bytes; action: transmitviolated 299536 packets, 42533074 bytes; action: dropClass-map: class-default (match-any)0 packets, 0 bytes5 minute offered rate 0 bps, drop rate 0 bpsMatch: any0 packets, 0 bytes5 minute rate 0 bpsRelated Commands
Feature Information for Control Plane Policing
Table 2 lists the features in this module and provides links to specific configuration information.
Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.
Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Note
CCVP, the Cisco Logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0609R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2006 Cisco Systems, Inc. All rights reserved.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)