Cisco WS-SUP32-GE-3B Software Configuration Guide - Page 481

Chapter 33 Configuring Denial of Service Protection CoPP Default Configuration The majority of traffic managed by the PISA is handled by way of the control and management planes. You can use CoPP to protect the control and management planes, and ensure routing stability, reachability, and packet delivery. CoPP uses a dedicated control plane configuration through the modular QoS CLI (MQC) to provide filtering and rate-limiting capabilities for the control plane packets. CoPP Default Configuration CoPP is disabled by default. CoPP Configuration Guidelines and Restrictions When configuring CoPP, follow these guidelines and restrictions: • Classes that match multicast are not applied in hardware but are applied in software. • CPP is not supported in hardware for broadcast packets. The combination of ACLs, traffic storm control, and CPP software protection provides protection against broadcast DoS attacks. • CoPP does not support ARP policies. ARP policing mechanisms provide protection against ARP storms. • CoPP does not support non-IP classes except for the default non-IP class. ACLs can be used instead of non-IP classes to drop non-IP traffic, and the default non-IP CoPP class can be used to limit to non-IP traffic that reaches the RP CPU. • Do not use the log keyword in CoPP policy ACLs. • If you have a large QoS configuration, the system may run out of TCAM space. If this is the case, CoPP may be performed in software. • When there is a large QoS configuration for other interfaces, you can run out of TCAM space. When this situation occurs, CoPP may be performed entirely in software and result in performance degradation and CPU cycle consumption. • You must ensure that the CoPP policy does not filter critical traffic such as routing protocols or interactive access to the switches. Filtering this traffic could prevent remote access to the switch, requiring a console connection. • The PFC3B supports built-in special-case rate limiters, which are useful for situations where an ACL cannot be used (for example, TTL, MTU, and IP options). When you enable the special-case rate limiters, you should be aware that the special-case rate limiters will override the CoPP policy for packets matching the rate-limiter criteria. • CoPP is not enabled in hardware unless MMLS QoS is enabled globally with the mls qos command. If the mls qos command is not entered, CoPP will only work in software and will not provide any benefit to the hardware. • Neither egress CoPP nor silent mode is supported. CoPP is only supported on ingress (service-policy output CoPP cannot be applied to the control plane interface). • ACE hit counters in hardware are only for ACL logic. You can rely on software ACE hit counters and the show access-list, show policy-map control-plane, and show mls ip qos commands to troubleshoot evaluate CPU traffic. • CoPP is performed on a per-forwarding-engine basis and software CoPP is performed on an aggregate basis. OL-11439-03 Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY 33-19