Cisco-COPP-ASR1001

Control Plane Policing (CoPP) (на примере ASR1001)

Очистка

Перед настройкой удалить существующие настройки

control-plane
 no service-policy input POLICY_MAP_COPP_INPUT_POLICY
exit
no policy-map POLICY_MAP_COPP_INPUT_POLICY

ACL

ip access-list extended ACCESS_LIST_COPP_TELNET

no ip access-list extended ACCESS_LIST_COPP_TELNET
ip access-list extended ACCESS_LIST_COPP_TELNET
 deny   tcp any any established
 permit tcp any any eq telnet
exit 

ip access-list extended ACCESS_LIST_COPP_SSH

no ip access-list extended ACCESS_LIST_COPP_SSH
ip access-list extended ACCESS_LIST_COPP_SSH
 deny   tcp any any established
 permit tcp any any eq 22
exit 

ip access-list extended ACCESS_LIST_COPP_SNMP

no ip access-list extended ACCESS_LIST_COPP_SNMP
ip access-list extended ACCESS_LIST_COPP_SNMP
 deny   udp 10.72.0.0 0.0.0.255 any eq 161
 permit udp any any eq 161
exit

ip access-list extended ACCESS_LIST_COPP_BGP

no ip access-list extended ACCESS_LIST_COPP_BGP
ip access-list extended ACCESS_LIST_COPP_BGP
 deny   tcp any any established
 deny   tcp 172.31.0.0 0.0.0.255 any eq 179
 permit tcp any any eq 179
exit

ip access-list extended ACCESS_LIST_COPP_RADIUS

no ip access-list extended ACCESS_LIST_COPP_RADIUS
ip access-list extended ACCESS_LIST_COPP_RADIUS
 deny   udp 172.31.0.0    0.0.0.255 any eq 1812
 deny   udp 172.31.0.0    0.0.0.255 any eq 1813
 deny   udp 100.100.100.0 0.0.0.255 any eq 1812
 deny   udp 100.100.100.0 0.0.0.255 any eq 1813
 permit tcp any any eq 1812
 permit tcp any any eq 1813
exit

class-map

class-map CLASS_MAP_COPP_TELNET

no class-map CLASS_MAP_COPP_TELNET
class-map CLASS_MAP_COPP_TELNET
  match access-group name ACCESS_LIST_COPP_TELNET
exit

class-map CLASS_MAP_COPP_SSH

no class-map CLASS_MAP_COPP_SSH
class-map CLASS_MAP_COPP_SSH
  match access-group name ACCESS_LIST_COPP_SSH
exit

class-map CLASS_MAP_COPP_SNMP

no class-map CLASS_MAP_COPP_SNMP
class-map CLASS_MAP_COPP_SNMP
  match access-group name ACCESS_LIST_COPP_SNMP
exit

class-map CLASS_MAP_COPP_BGP

no class-map CLASS_MAP_COPP_BGP
class-map CLASS_MAP_COPP_BGP
  match access-group name ACCESS_LIST_COPP_BGP
exit

class-map CLASS_MAP_COPP_RADIUS

no class-map CLASS_MAP_COPP_RADIUS
class-map CLASS_MAP_COPP_RADIUS
  match access-group name ACCESS_LIST_COPP_RADIUS
exit

policy-map POLICY_MAP_COPP_INPUT_POLICY

policy-map разбита на части для удобства восприятия

• Строчка police cir 32000 bc 1500 be 1500 conform-action drop exceed-action drop violate-action drop эквивалентно действию drop так как на некоторых платформах это действие недоступно

• Удалить и заново добавить policy-map

no policy-map POLICY_MAP_COPP_INPUT_POLICY
policy-map POLICY_MAP_COPP_INPUT_POLICY

telnet

! Deny telnet
 class CLASS_MAP_COPP_TELNET
  police cir 32000 bc 1500 be 1500 conform-action drop exceed-action drop violate-action drop
  exit
 exit

ssh

! Deny ssh
 class CLASS_MAP_COPP_SSH
  police cir 32000 bc 1500 be 1500 conform-action drop exceed-action drop violate-action drop
  exit
 exit

snmp

! Deny SNMP
 class CLASS_MAP_COPP_SNMP
  police cir 32000 bc 1500 be 1500 conform-action drop exceed-action drop violate-action drop
  exit
 exit
!

BGP

! Deny BGP
 class CLASS_MAP_COPP_BGP
  police cir 32000 bc 1500 be 1500 conform-action drop exceed-action drop violate-action drop
  exit
 exit
!

Radius

! Deny RADIUS
 class CLASS_MAP_COPP_RADIUS
  police cir 32000 bc 1500 be 1500 conform-action drop exceed-action drop violate-action drop
  exit
 exit
!

Остальной траффик

! Permit other (include LACP)
 class class-default
  police cir 32000 bc 1500 be 1500 conform-action transmit exceed-action transmit violate-action transmit
  exit
 exit
exit

control-plane

control-plane
 no service-policy input POLICY_MAP_COPP_INPUT_POLICY
 service-policy input POLICY_MAP_COPP_INPUT_POLICY
exit