Control Plane Policing
Last updated
Last updated
IP addresses and OSPF are already preconfigured.
On R2, configure CoPP to drop ICMP above 64Kbps and SSH above 32Kbps. However, Lo1 (1.1.1.2) is a “management station” which needs unrestricted access to R2, so you should not rate-limit ICMP and SSH from 1.1.1.2. When pinging 2.2.2.2 from Lo0 on R1 with a size of 1000 bytes (8000 bits), only 8 pings should get through per second. However pings from Lo1 should work with no drops. Note that to achieve 8 pings with the 9th ping lost, I had to adjust the burst size.
2. On XR, we cannot police traffic based on the source address. Instead simply limit ICMP to 10pps and unestablished SSH traffic to 20 pps. When pinging R3, I am only able to get 8 pings to go through, not 10. I believe this is because the burst size is not configurable.
Verify that ICMP traffic is droped and that the SSH rate has changed.
You need to preform different policing rates on icmp and ssh, and also permit traffic from 1.1.1.2 unrestricted. I created three ACLs: one matching icmp, one matching ssh, and one for permitted hosts.
Strangely, the permited-hosts logic is backwards. 1.1.1.2 is used as a destination. This is the only way traffic would match for me. When I used 1.1.1.2 any, I never got hits.
Next I created three class-maps (not shown) and a single policy-map.
To achieve 8 consecutive pings I increased the burst rate for icmp. Otherwise, the default burst size was too low and after two pings, the bps rate was exceed at the fractional second level. (The router polices based on a fraction of a second, so for example 64000/8 bps were exceeded within 1/8 of a second).
To test this hypothesis, I used a VyOS router which allows for a configurable ping interval. If I ping at an interval of 1/9 seconds (0.111 repeating) with 1000byte packets, then the burst rate is not exceeded and I can fit 8 pings into a second, with the 9th packet dropping.
LPTS is much more simple to configure on XR.
To verify use the following show command:
