300-410 ENARSI: Implementing Cisco Enterprise Advanced Routing and ServicesDemo

By Cisco · Question Mode

QuestionQ495

Infrastructure Security

A network administrator configured a router for Control Plane Policing so that inbound SSH traffic is policed at 500 kbps. The policy must apply to traffic arriving from the 10.10.10.0/24 and 192.168.10.0/24 networks.

access-list 100 permit ip 10.10.10.0 0.0.0.255 any  
access-list 100 permit tcp 192.168.10.0 0.0.0.255 any eq 23  
!  
class-map CLASS-SSH  
match access-group 100  
!  
policy-map PM-COPP  
class CLASS-SSH  
police 500000 conform-action transmit  
!  
interface E0/0  
service-policy input PM-COPP  
!  
interface E0/1  
service-policy input PM-COPP

Control Plane Policing is not applied to SSH traffic, and SSH can use any available bandwidth. Which configuration fixes this issue?

  • A no access-list 100access-list 100 permit tcp 10.10.10.0 0.0.0.255 any eq 22access-list 100 permit tcp 192.168.10.0 0.0.0.255 any eq 22
  • B interface E0/0no service-policy input PM-COPP!interface E0/1no service-policy input PM-COPP!control-planeservice-policy input PM-COPP
  • C no access-list 100access-list 100 permit tcp 10.10.10.0 0.0.0.255 any eq 22access-list 100 permit tcp 192.168.10.0 0.0.0.255 any eq 22!policy-map PM-COPPclass CLASS-SSHno police 500000 conform-action transmitpolice 500000 conform-action transmit exceed-action drop
  • D no access-list 100access-list 100 permit tcp 10.10.10.0 0.0.0.255 any eq 22access-list 100 permit tcp 192.168.10.0 0.0.0.255 any eq 22!interface E0/0no service-policy input PM-COPP!interface E0/1no service-policy input PM-COPP!control-planeservice-policy input PM-COPP
Explanation

SSH traffic is TCP port 22, so the classifier must permit TCP/22 from both specified source networks; port 23 identifies Telnet. A Control Plane Policing policy must be applied with service-policy input PM-COPP in control-plane configuration mode, which attaches the QoS policy to packets received by the router control plane rather than applying an interface QoS policy.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!