Control Plane Policing

Control Plane Policing (CoPP) protects the supervisor of NX-OS devices by classifying and rate-limiting traffic that is punted to the CPU. A predefined CoPP profile (copp profile strict | moderate | lenient | dense) can be selected, or a custom control-plane policy can be built from control-plane class maps (class-map type control-plane) and policy maps (policy-map type control-plane) and applied with control-plane > service-policy input <name>. Control-plane class maps match access lists, exception packets (for example glean, TTL or MTU failures, IP options, ICMP redirects and multicast RPF failures), redirected packets and protocols. Each class of a control-plane policy map polices matching traffic with a CIR (and optionally PIR) rate and burst, and can mark CoS or DSCP and log dropped packets. The short form police pps <rate> is configured as cir_rate: <rate> with cir_unit: pps. Applying a custom service policy replaces the CoPP profile; to remove it, select a CoPP profile again. Support for individual match and set options depends on the platform.

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
qos	Class	qos	No
system	Class	system	No

qos (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
control_plane_class_maps	List	control_plane_class_maps	No
control_plane_policy_maps	List	control_plane_policy_maps	No

system (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
control_plane_service_policy_input	String		No
copp_profile	Choice	strict, moderate, lenient, dense	No
copp_rate_limit	Boolean	true, false	No

control_plane_class_maps (nxos.devices.configuration.qos)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
match_type	Choice	match-any, match-all	No
match_access_group_names	List	String	No
match_exceptions	List	Choice[glean, mtu-failure, ttl-failure, nat-flow, sflow, span, mvpn, vxlan-stp]	No
match_exception_ip_option	Boolean	true, false	No
match_exception_ip_icmp	List	Choice[redirect, unreachable]	No
match_exception_ipv6_option	Boolean	true, false	No
match_exception_ipv6_icmp	List	Choice[redirect, unreachable]	No
match_exception_multicast	List	Choice[dest-miss, rpf-failure, sg-rpf-failure, ipv6-dest-miss, ipv6-rpf-failure, ipv6-sg-rpf-failure]	No
match_protocol_arp	Boolean	true, false	No
match_protocol_mpls	Boolean	true, false	No
match_protocol_mpls_router_alert	Boolean	true, false	No
match_protocol_mpls_exp	Integer	min: 0, max: 7	No
match_redirect	Choice	arp-inspect, dhcp-snoop	No

control_plane_policy_maps (nxos.devices.configuration.qos)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
classes	List	classes	No

classes (nxos.devices.configuration.qos.control_plane_policy_maps)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
insert_before	String		No
police	Class	police	No
set_cos	Integer	min: 0, max: 7	No
set_cos_inner	Boolean	true, false	No
set_dscp	Integer	min: 0, max: 63	No
set_dscp_tunnel	Boolean	true, false	No
logging_drop_threshold	Integer	min: 0, max: 9223372036854775807	No
logging_drop_level	Integer	min: 1, max: 7	No

police (nxos.devices.configuration.qos.control_plane_policy_maps.classes)

Name	Type	Constraint	Mandatory	Default Value
cir_rate	Integer	min: 0, max: 9223372036854775807	Yes
cir_unit	Choice	bps, kbps, mbps, gbps, pps	No
bc_rate	Integer	min: 0, max: 4294967295	No
bc_unit	Choice	bytes, kbytes, mbytes, ms, us, packets	No
pir_rate	Integer	min: 0, max: 9223372036854775807	No
be_rate	Integer	min: 0, max: 4294967295	No
be_unit	Choice	bytes, kbytes, mbytes, ms, us, packets	No
conform_action	Choice	transmit, drop	No
exceed_action	Choice	transmit, drop	No
violate_action	Choice	transmit, drop	No

Examples

Example 1: Predefined CoPP profile

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          copp_profile: strict

Example 2: Custom control-plane policy that polices management and ARP traffic (class-map type control-plane, policy-map type control-plane, control-plane > service-policy input)

nxos:
  devices:
    - name: LEAF1
      configuration:
        ip_access_lists:
          - name: ACL-COPP-MGMT
            entries:
              - sequence_number: 10
                action: permit
                protocol: tcp
                source:
                  prefix: 10.0.0.0
                  prefix_length: 8
                destination:
                  prefix: any
                  port_operator: eq
                  port_1: 22
        qos:
          control_plane_class_maps:
            - name: CM-COPP-MGMT
              match_type: match-any
              match_access_group_names:
                - ACL-COPP-MGMT
            - name: CM-COPP-ARP
              match_type: match-any
              match_protocol_arp: true
          control_plane_policy_maps:
            - name: PM-COPP
              classes:
                - name: CM-COPP-MGMT
                  police:
                    cir_rate: 5000
                    cir_unit: pps
                    bc_rate: 128
                    bc_unit: packets
                    conform_action: transmit
                    violate_action: drop
                - name: CM-COPP-ARP
                  police:
                    cir_rate: 1000
                    cir_unit: pps
                    bc_rate: 64
                    bc_unit: packets
                    conform_action: transmit
                    violate_action: drop
                  set_cos: 6
                  logging_drop_threshold: 1000
                  logging_drop_level: 5
        system:
          control_plane_service_policy_input: PM-COPP

Example 3: Control-plane class map matching exception packets (match exception glean, match exception ip option, match exception ip icmp redirect, match exception ipv6 icmp unreachable, match exception multicast rpf-failure)

nxos:
  devices:
    - name: LEAF1
      configuration:
        qos:
          control_plane_class_maps:
            - name: CM-COPP-EXCEPTION
              match_type: match-any
              match_exceptions:
                - glean
                - ttl-failure
                - mtu-failure
              match_exception_ip_option: true
              match_exception_ip_icmp:
                - redirect
              match_exception_ipv6_option: true
              match_exception_ipv6_icmp:
                - unreachable
              match_exception_multicast:
                - rpf-failure
                - dest-miss
          control_plane_policy_maps:
            - name: PM-COPP
              classes:
                - name: CM-COPP-EXCEPTION
                  police:
                    cir_rate: 50
                    cir_unit: pps
                    bc_rate: 32
                    bc_unit: packets
                    conform_action: transmit
                    violate_action: drop