Dell Force10 Z9000 FTOS Configuration Guide for Z9000 System - Page 279

11 Control Plane Policing (CoPP) z Control Plane Policing (CoPP) is supported on platforms: Overview Control Plane Policing (CoPP) uses ACL rules and QoS policies to create filters for a system's control plane. That filter prevents traffic not specifically identified as legitimate from reaching the system control plane, rate-limits, traffic to an acceptable level. Control Plane Policing (CoPP) increases security on the system by protecting the Routing Processor from unnecessary or DoS traffic, giving priority to important control plane and management traffic. CoPP uses a dedicated control plane configuration through the ACL and QoS CLIs to provide filtering and rate-limiting capabilities for the control plane packets. Front End Ports Protocol to Queue Classification (Ingress Flow Entries) CPU Software Queue CPU Processes (OSPF, LACP, STP, ICMP, etc) Figure 11-1. CoPP architecture example Hardware Queue Rate Limiting OPSF ICMP PING Packets OSPF, VRRP, RIPv2, IGMP, PIM, xSTP, LACP, PVST, GVRP, LLDP Q7 1100 PPS BGP, ICMP Echo, ICMP Reply, ARP Reply, NTP L3 Local Traffic Q6 400 PPS ARP Req, DHCP, Unknown L3, L2 Broadcast on L3 VLAN, Broadcast L2 DST on VLAN6095 Stacking, IPC, IRC, VLT Q5 400 PPS Q4 2000 PPS sFlow MAC Learning Limit Violation Log, HyperPull Q3 300 PPS Q2 300 PPS MC Data BFD Q1 300 PPS Q0 1300 PPS CoPP Rule Examples 200 PPS Per-Protocol Rate Limiting OSPF 200 PPS BGP 100 PPS STP 100 PPS ICMP 50 PPS . . . . 50 PPS OPSF ICMP PING Figure 11-2 show an example of the difference bet wen having CoPP implemented and not having CoPP implemented. Control Plane Policing (CoPP) | 279