What is control plane policing, and how would you build a CoPP policy?
Show the answer
Say this first
CoPP is a QoS policy applied to the traffic punted to the device's CPU: routing protocols, management,
ARP, ICMP to the box, packets with IP options or an expiring TTL. Without it, a flood aimed at the
router or a misbehaving neighbor can starve the CPU, and I lose routing adjacencies and management at
the worst moment. I classify punted traffic into classes (critical routing, management, ICMP and
monitoring, everything else), police each class to a rate that fits normal levels with headroom, and
apply it with service-policy input under control-plane.
Go deeper
Example on an IOS-XE router
ip access-list extended COPP-ROUTING
permit tcp host 10.0.12.2 host 10.0.12.1 eq bgp
permit tcp host 10.0.12.2 eq bgp host 10.0.12.1
permit ospf any any
ip access-list extended COPP-MGMT
permit tcp 10.99.0.0 0.0.0.255 any eq 22
permit udp 10.99.0.0 0.0.0.255 any eq snmp
permit udp host 10.99.0.10 eq ntp any
ip access-list extended COPP-ICMP
permit icmp any any echo
permit icmp any any echo-reply
permit icmp any any ttl-exceeded
permit icmp any any unreachable
!
class-map match-all CM-COPP-ROUTING
match access-group name COPP-ROUTING
class-map match-all CM-COPP-MGMT
match access-group name COPP-MGMT
class-map match-all CM-COPP-ICMP
match access-group name COPP-ICMP
!
policy-map PM-COPP
class CM-COPP-ROUTING
police 2000000 conform-action transmit exceed-action transmit
class CM-COPP-MGMT
police 1000000 conform-action transmit exceed-action drop
class CM-COPP-ICMP
police 128000 conform-action transmit exceed-action drop
class class-default
police 256000 conform-action transmit exceed-action drop
!
control-plane
service-policy input PM-COPPThe routing class only measures (exceed is still transmitted), so a burst after a big BGP update is never dropped. Rates here are in bits per second.
Things that catch people
- In a CoPP class ACL,
permitmeans "belongs to this class" anddenymeans "try the next class". Nothing is dropped by the ACL itself. - ARP is not IP, so IP ACLs never match it. It falls into
class-defaultunless you add a class withmatch protocol arp. Police class-default too hard and ARP breaks. - Roll out with
exceed-action transmiteverywhere first, readshow policy-map control-plane, then set drops.
Platform notes
- Catalyst 9000 switches ship with a system CoPP policy (
system-cpp-policy) whose class rates you tune. - NX-OS applies a default CoPP profile (strict, moderate, lenient or dense) at setup.
- Junos does the same job with a firewall filter applied as input on the
lo0interface.
They will ask next
Does CoPP protect against a flood passing through the router?
No. Transit traffic is forwarded in hardware or CEF and never reaches the CPU. CoPP only sees what is punted. Transit floods need edge ACLs, uRPF or upstream mitigation.
How do you choose the rates?
Measure normal punt rates per class in monitor mode, then test the worst legitimate cases, like a full BGP table reload or an OSPF reconvergence, and set the policer above those peaks.
Traps
- Policing routing protocols so tightly that a reconvergence drops hellos and the network flaps.
- Reading deny lines in a CoPP ACL as "drop this traffic".