QuestionQ529

Infrastructure Security

A network administrator configured CoPP so that all routing-protocol traffic destined for the router CPU is limited to 1 mbps. Any traffic exceeding that limit must be dropped. The router runs BGP and OSPF. Telnet and SSH management traffic must be limited to 500 kbps.

access-list 100 permit tcp any any eq 179  
access-list 100 permit tcp any any range 22 23  
access-list 100 permit ospf any any  
!  
class-map CM-ROUTING  
match access-group 100  
class-map CM-MGMT  
match access-group 100  
!  
policy-map PM-COPP  
class CM-ROUTING  
police 1000000 conform-action transmit  
class CM-MGMT  
police 500000 conform-action transmit  
!  
control-plane  
service-policy output PM-COPP  

No traffic is being filtered through CoPP, resulting in high CPU utilization. Which configuration resolves the issue?

  • A control-planeno service-policy output PM-COPPservice-policy input PM-COPP
  • B no access-list 100access-list 100 permit tcp any any eq 179access-list 100 permit ospf any anyaccess-list 101 permit tcp any any range 22 23!!class-map CM-MGMTno match access-group 100match access-group 101
  • C no access-list 100access-list 100 permit tcp any any eq 179access-list 100 permit ospf any anyaccess-list 101 permit tcp any any range 22 23!!class-map CM-MGMTno match access-group 100match access-group 101!control-planeno service-policy output PM-COPPservice-policy input PM-COPP
  • D No access-list 100 -access-list 100 permit tcp any any eq 179access-list 100 permit tcp any any range eq 22access-list 100 permit tcp any any range eq 23access-list 100 permit ospf any any
Explanation

Traffic destined to the router control plane must be policed with a control-plane service policy in the input direction. BGP and OSPF should remain in the routing ACL, while Telnet and SSH require a separate ACL referenced by the management class map so that each traffic type receives its intended policing rate.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!