300-410 ENARSI: Implementing Cisco Enterprise Advanced Routing and ServicesDemo

By Cisco · Question Mode

QuestionQ133

Infrastructure Security

The network administrator configured CoPP so that all HTTP and HTTPS traffic from the administrator device at 172.16 1.99 to the router CPU is limited to 500 kbps. Any traffic exceeding this limit must be dropped.

access-list 100 permit ip host 172.16.1.99 any  
!  
class-map CM-ADMIN  
match access-group 100  
!  
policy-map PM-COPP  
class CM-ADMIN  
police 500000 conform-action transmit  
!  
interface E0/0  
service-policy input PM-COPP

CoPP did not capture the intended traffic, and CPU utilization is increasing.

Which two configurations resolve the issue?

Choose two
  • A interface E0/0 no service-policy input PM-COPP ! control-plane service-policy input PM-COPP
  • B policy-map PM-COPP class CM-ADMIN no police 500000 conform-action transmit police 500 conform-action transmit ! control-plane service-policy input PM-COPP
  • C no access-list 100 access-list 100 permit tcp host 172.16.1.99 any eq 80
  • D no access-list 100 access-list 100 permit tcp host 172.16.1.99 any eq 80 access-list 100 permit tcp host 172.16.1.99 any eq 443
  • E policy-map PM-COPP class CM-ADMIN no police 500000 conform-action transmit police 500 conform-action transmit
Explanation

CoPP policy maps must be attached inbound to the control plane so they classify and police traffic destined for the router CPU. The classification ACL must match TCP traffic from 172.16.1.99 with destination ports 80 and 443 to cover HTTP and HTTPS only. A police rate of 500000 is 500,000 bps (500 kbps), whereas 500 would be only 500 bps. Cisco documents applying CoPP with control-plane and service-policy input, and documents extended ACL protocol and port matching for traffic classification.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!