Control Plane Policing
Last updated
Last updated
IP addresses and OSPF are already preconfigured.
On R2, configure CoPP to drop ICMP above 64Kbps and SSH above 32Kbps. However, Lo1 (1.1.1.2) is a “management station” which needs unrestricted access to R2, so you should not rate-limit ICMP and SSH from 1.1.1.2. When pinging 2.2.2.2 from Lo0 on R1 with a size of 1000 bytes (8000 bits), only 8 pings should get through per second. However pings from Lo1 should work with no drops. Note that to achieve 8 pings with the 9th ping lost, I had to adjust the burst size.
R1#ping 2.2.2.2 source lo0 size 1000 timeout 1 repeat 27
Type escape sequence to abort.
Sending 27, 1000-byte ICMP Echos to 2.2.2.2, timeout is 1 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!!!!.!!!!!!!!.!!!!!!!!.
Success rate is 88 percent (24/27), round-trip min/avg/max = 1/1/11 ms
R1#ping 2.2.2.2 source lo1 size 1000 timeout 1 repeat 27
Type escape sequence to abort.
Sending 27, 1000-byte ICMP Echos to 2.2.2.2, timeout is 1 seconds:
Packet sent with a source address of 1.1.1.2
!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (27/27), round-trip min/avg/max = 1/1/9 m2. On XR, we cannot police traffic based on the source address. Instead simply limit ICMP to 10pps and unestablished SSH traffic to 20 pps. When pinging R3, I am only able to get 8 pings to go through, not 10. I believe this is because the burst size is not configurable.
R1#ping 3.3.3.3 source lo0 timeout 1 repeat 40 size 1000
Type escape sequence to abort.
Sending 40, 1000-byte ICMP Echos to 3.3.3.3, timeout is 1 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!!!!.!!!!!!!!.!!!!!!!!.!!!!!!!!.!!!!
Success rate is 90 percent (36/40), round-trip min/avg/max = 3/5/14 msVerify that ICMP traffic is droped and that the SSH rate has changed.
You need to preform different policing rates on icmp and ssh, and also permit traffic from 1.1.1.2 unrestricted. I created three ACLs: one matching icmp, one matching ssh, and one for permitted hosts.
Extended IP access list icmp
10 permit icmp any any
Extended IP access list permited-hosts
10 permit ip any host 1.1.1.2
Extended IP access list ssh
10 permit tcp any any eq 22Strangely, the permited-hosts logic is backwards. 1.1.1.2 is used as a destination. This is the only way traffic would match for me. When I used 1.1.1.2 any, I never got hits.
Next I created three class-maps (not shown) and a single policy-map.
R2#show policy-map control-plane
Control Plane
Service-policy input: CoPP
Class-map: permited-hosts (match-all)
74 packets, 74000 bytes
5 minute offered rate 0000 bps
Match: access-group name permited-hosts
Class-map: icmp (match-all)
743 packets, 743000 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: access-group name icmp
police:
cir 64000 bps, bc 8000 bytes
conformed 652 packets, 652000 bytes; actions:
transmit
exceeded 100 packets, 100000 bytes; actions:
drop
conformed 0000 bps, exceeded 0000 bps
Class-map: ssh (match-all)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: access-group name ssh
police:
cir 32000 bps, bc 1500 bytes
conformed 0 packets, 0 bytes; actions:
transmit
exceeded 0 packets, 0 bytes; actions:
drop
conformed 0000 bps, exceeded 0000 bps
show run | sec policy-map
policy-map CoPP
! By not specifying anything under permited hosts, no policing is taking place.
! It is important that permited-hosts is at the top so that traffic from 1.1.1.2 isn't rate limited.
class permited-hosts
class icmp
police cir 64000 bc 8000 conform-action transmit exceed-action drop
class ssh
police 32000 conform-action transmit exceed-action dropTo achieve 8 consecutive pings I increased the burst rate for icmp. Otherwise, the default burst size was too low and after two pings, the bps rate was exceed at the fractional second level. (The router polices based on a fraction of a second, so for example 64000/8 bps were exceeded within 1/8 of a second).
To test this hypothesis, I used a VyOS router which allows for a configurable ping interval. If I ping at an interval of 1/9 seconds (0.111 repeating) with 1000byte packets, then the burst rate is not exceeded and I can fit 8 pings into a second, with the 9th packet dropping.
! From the CSR1000v, pings are sent too quickly:
R1#ping 2.2.2.2 source lo0 size 1000 timeout 1 repeat 10
Type escape sequence to abort.
Sending 10, 1000-byte ICMP Echos to 2.2.2.2, timeout is 1 seconds:
Packet sent with a source address of 1.1.1.1
!!.!!.!!.!
Success rate is 70 percent (7/10), round-trip min/avg/max = 1/1/2 ms
! From VyOS I can tune the ping interval. At .111 seconds, the ninth ping is dropped.
vyos@vyos:~$ ping 2.2.2.2 interval .111 size 1000
PING 2.2.2.2 (2.2.2.2) 1000(1028) bytes of data.
1008 bytes from 2.2.2.2: icmp_seq=1 ttl=254 time=1.38 ms
1008 bytes from 2.2.2.2: icmp_seq=2 ttl=254 time=1.56 ms
1008 bytes from 2.2.2.2: icmp_seq=3 ttl=254 time=2.07 ms
1008 bytes from 2.2.2.2: icmp_seq=4 ttl=254 time=1.98 ms
1008 bytes from 2.2.2.2: icmp_seq=5 ttl=254 time=1.83 ms
1008 bytes from 2.2.2.2: icmp_seq=6 ttl=254 time=2.16 ms
1008 bytes from 2.2.2.2: icmp_seq=7 ttl=254 time=2.42 ms
1008 bytes from 2.2.2.2: icmp_seq=8 ttl=254 time=2.24 ms
1008 bytes from 2.2.2.2: icmp_seq=10 ttl=254 time=2.08 msLPTS is much more simple to configure on XR.
lpts pifib hardware police
flow icmp local rate 10
flow ssh default rate 20To verify use the following show command:
RP/0/RP0/CPU0:XR3#show lpts pifib hardware police location 0/0/CPU0 | in "SSH|---|flow_type"
Tue Nov 8 14:07:26.160 UTC
-------------------- -------- ------------ --------------- ---------- ----- -------------- ------------ ----------- --------- ----------
flow_type priority sw_police_id hw_policer_addr Cur. Rate burst static_avgrate avgrate_type AggrAccepts AggrDrops TOS Value
-------------------- -------- ------------ --------------- ---------- ----- -------------- ------------ ----------- --------- ----------
SSH-known medium 27 240 300 150 300 Static 0 0 01234567
SSH-default low 28 241 20 100 200 Global 0 0 01234567
RP/0/RP0/CPU0:XR3#show lpts pifib hardware police location 0/0/CPU0 | in "ICMP|---|flow_type"
Tue Nov 8 14:20:57.928 UTC
-------------------- -------- ------------ --------------- ---------- ----- -------------- ------------ ----------- --------- ----------
flow_type priority sw_police_id hw_policer_addr Cur. Rate burst static_avgrate avgrate_type AggrAccepts AggrDrops TOS Value
-------------------- -------- ------------ --------------- ---------- ----- -------------- ------------ ----------- --------- ----------
ICMP-local medium 12 225 10 750 1500 Global 112 12 01234567
ICMP-control high 40 253 1000 500 1000 Static 0 0 01234567
ICMP-app low 52 265 1500 750 1500 Static 0 0 01234567
ICMP-default low 53 266 1500 750 1500 Static 0 0 01234567
ICMP-app-default low 90 303 1500 750 1500 Static 0 0 01234567