Control Plane

CoPP – Control Plane Policing
Control Plane Policing is used to apply policy maps to traffic going to or coming from the control plane. This feature also mitigates DoS attacks by filtering traffic that arrives at the processor.
First, you should define a policy-map using MQC. Then, apply this policy map to the control-plane:
1
R(config)# control-plane
2
R(config-cp)# service-policy {input|output} POLICY-MAP
Copied!
CoPPr – Control Plane Protection
Control Plane Protection is similar to the policing feature, except it offers a more granular access to the control plane functions.
You still need to define a policy-map using MQC. But now you can apply it on a sub-interface of the virtual control-plane interface:
1
R(config)# control-plane {host|transit|cef-exception}
2
! host - controls traffic that is directly destined for one of the router interfaces
3
! transit - controls traffic that is software-switched
4
! cef-exception - controls traffic that cannot be switched by CEF
5
R(config-cp-transit)# service-polcy input POLICY-MAP
Copied!
Layer 4 Port Protection
On the host subinterface you can use a special type of policy-map to deny access-to specific ports.
First create the special class-map and policy-map:
1
R(config)# class-map type port-filter [match-all|match-any] PORT-FILTER-CLASS
2
R(config-cmap)# match [not] {closed-ports|port {tcp|udp} START-PORT [END-PORT]}
Copied!
The closed-ports keyword should mean all ports that are not open on the control plane. Filtering traffic to the closed ports should spare the processor from unnecessary work.
To see a list of open ports, use:
1
R# show control-plane host open-ports
Copied!
Beware of the fact that some protocols (usually routing protocols) will not show up with open ports, so they should be specifically allowed if they are used.
Then create the policy map:
1
R(config)# policy-map type port-filter PORT-FILTER-POLICY
2
R(config-pmap)# class PORT-FILTER-CLASS
3
R(config-pmap-c)# drop
Copied!
In the end, apply it on the host subinterface:
1
R(config-cp-host)# service-policy type port-filter input PORT-FILTER-POLICY
Copied!
Queue Threshold Protection
Similar to the previous feature, you can set how long the queue of the control-plane host subinterface can be. Follow these steps to define the class-map and the policy-map:
1
R(config)#class-map type queue-threshold [match-all|match-any] QUEUE-TH-CLASS
2
R(config-cmap)# match [not] {protocol [PROTOCOL]|host-protocols}
3
! host-protocols - any open TCP/UDP port on the router
4
R(config)# policy-map type queue-threshold QUEUE-TH-POLICY
5
R(config-pmap)# class QUEUE-TH-CLASS
6
R(config-pmap-c)# queue-limit LIMIT
Copied!
Then, apply it on the host subinterface:
1
R(config-pmap-host)# service-policy type queue-threshold input QUEUE-TH-POLICY
Copied!
Managenet Interfaces
Additionally, on the host subinterface, you can define what management protocols are allowed on each physical interface:
1
R(config-cp-host)# management-interface INTERFACE allow [PROTOCOL]
Copied!
Control Plane Logging
For traffic that arrives at the control plane (that is traffic that is not cef-switched), the control-plane can limit the amount of logging it does.
To enable this feature, first define a logging class-map and policy-map:
1
R(config)# class-map type logging match-all LOG-CLASS
2
! Match by input interface:
3
R(config-cmap)# match [not] input-interface INTERFACE
4
! Match on source or destination address
5
R(config-cmap)# match [not] ipv4 {destination-address|source-address} IP-ADDR
6
! Match on packet action
7
R(config-cmap)# match [not] packets {dropped|error|permitted}
8
R(config)# policy-map type logging LOG-POLICY
9
R(config-pmap)# class LOG-CLASS
10
R(config-pmap-c)# log [interval SEC|total-length|ttl]
11
! interval - logs packets at the specified interval
12
! total-length - logs also packet length
13
! ttl - logs also ttl value
Copied!
Apply the logging policy-map to the control plane interface or one of its subinterfaces:
1
R(config)# control-plane [host|transit|cef-exception]
2
R(config-cp)# service-policy type logging input LOG-POLICY
Copied!

Security - Previous

Controlling CLI Access

Next - Security

Switch Security

Last modified 6mo ago

Copy link

Contents

CoPP – Control Plane Policing

CoPPr – Control Plane Protection

Layer 4 Port Protection

Queue Threshold Protection

Managenet Interfaces

Control Plane Logging