0

I have a pair of nexus 3064 and I want to secure their control plane but nexus series do not allow us to assign custom policy or class map to control-plane command thus I was thinking to use system qos type input command , my question is, if I use this "system qos type input MY_POLICY_MAP" is it working like as control-plane command and packets will be dropped before reaching CPU ? Thank you.

Improve this question

1 Answer 1

Reset to default
1

You most certainly can define your own COPP... "control-plane" then "service-policy ..." If you use the recommended "setup" method, it'll build a rather lengthy policy for you:

ip access-list copp-system-acl-eigrp
  10 permit eigrp any 224.0.0.10/32 
ipv6 access-list copp-system-acl-eigrp6
  10 permit eigrp any ff02::a/128 
ip access-list copp-system-acl-icmp
  10 permit icmp any any 
ip access-list copp-system-acl-igmp
  10 permit igmp any any 
ip access-list copp-system-acl-ntp
  10 permit udp any any eq ntp 
  20 permit udp any eq ntp any 
ip access-list copp-system-acl-pimreg
  10 permit pim any any 
ip access-list copp-system-acl-ping
  10 permit icmp any any echo 
  20 permit icmp any any echo-reply 
ip access-list copp-system-acl-routingproto1
  10 permit tcp any gt 1024 any eq bgp 
  20 permit tcp any eq bgp any gt 1024 
  30 permit udp any 224.0.0.0/24 eq rip 
  40 permit tcp any gt 1024 any eq 639 
  50 permit tcp any eq 639 any gt 1024 
  70 permit ospf any any 
  80 permit ospf any 224.0.0.5/32 
  90 permit ospf any 224.0.0.6/32 
ip access-list copp-system-acl-routingproto2
  10 permit udp any 224.0.0.0/24 eq 1985 
  20 permit 112 any 224.0.0.0/24 
ip access-list copp-system-acl-snmp
  10 permit udp any any eq snmp 
  20 permit udp any any eq snmptrap 
ip access-list copp-system-acl-ssh
  10 permit tcp any any eq 22 
  20 permit tcp any eq 22 any 
ip access-list copp-system-acl-stftp
  10 permit udp any any eq tftp 
  20 permit udp any any eq 1758 
  30 permit udp any eq tftp any 
  40 permit udp any eq 1758 any 
  50 permit tcp any any eq 115 
  60 permit tcp any eq 115 any 
ip access-list copp-system-acl-tacacsradius
  10 permit tcp any any eq tacacs 
  20 permit tcp any eq tacacs any 
  30 permit udp any any eq 1812 
  40 permit udp any any eq 1813 
  50 permit udp any any eq 1645 
  60 permit udp any any eq 1646 
  70 permit udp any eq 1812 any 
  80 permit udp any eq 1813 any 
  90 permit udp any eq 1645 any 
  100 permit udp any eq 1646 any 
ip access-list copp-system-acl-telnet
  10 permit tcp any any eq telnet 
  20 permit tcp any any eq 107 
  30 permit tcp any eq telnet any 
  40 permit tcp any eq 107 any 
ipv6 access-list copp-system-acl-v6routingProto2
  10 permit udp any ff02::66/128 eq 2029 
  20 permit udp any ff02::fb/128 eq 5353 
ipv6 access-list copp-system-acl-v6routingproto1
  10 permit 89 any ff02::5/128 
  20 permit 89 any ff02::6/128 
  30 permit udp any ff02::9/128 eq 521 
ip access-list copp-system-dhcp-relay
  10 permit udp any eq bootps any eq bootps 

class-map type control-plane match-any copp-icmp
  match access-group name copp-system-acl-icmp
class-map type control-plane match-any copp-ntp
  match access-group name copp-system-acl-ntp
class-map type control-plane match-any copp-s-arp
class-map type control-plane match-any copp-s-bfd
class-map type control-plane match-any copp-s-bpdu
class-map type control-plane match-any copp-s-dai
class-map type control-plane match-any copp-s-default
class-map type control-plane match-any copp-s-dhcpreq
class-map type control-plane match-any copp-s-dhcpresp
  match access-group name copp-system-dhcp-relay
class-map type control-plane match-any copp-s-dpss
class-map type control-plane match-any copp-s-eigrp
  match access-group name copp-system-acl-eigrp
  match access-group name copp-system-acl-eigrp6
class-map type control-plane match-any copp-s-glean
class-map type control-plane match-any copp-s-igmp
  match access-group name copp-system-acl-igmp
class-map type control-plane match-any copp-s-ipmcmiss
class-map type control-plane match-any copp-s-l2switched
class-map type control-plane match-any copp-s-l3destmiss
class-map type control-plane match-any copp-s-l3mtufail
class-map type control-plane match-any copp-s-l3slowpath
class-map type control-plane match-any copp-s-mpls
class-map type control-plane match-any copp-s-pimautorp
class-map type control-plane match-any copp-s-pimreg
  match access-group name copp-system-acl-pimreg
class-map type control-plane match-any copp-s-ping
  match access-group name copp-system-acl-ssh
  match access-group name copp-system-acl-ping
  match access-group name copp-system-acl-routingproto1
class-map type control-plane match-any copp-s-ptp
class-map type control-plane match-any copp-s-routingProto1
  match access-group name copp-system-acl-routingproto1
  match access-group name copp-system-acl-v6routingproto1
class-map type control-plane match-any copp-s-routingProto2
  match access-group name copp-system-acl-routingproto2
class-map type control-plane match-any copp-s-selfIp
class-map type control-plane match-any copp-s-ttl1
class-map type control-plane match-any copp-s-v6routingProto2
  match access-group name copp-system-acl-v6routingProto2
class-map type control-plane match-any copp-s-vxlan
class-map type control-plane match-any copp-snmp
  match access-group name copp-system-acl-snmp
class-map type control-plane match-any copp-ssh
  match access-group name copp-system-acl-ssh
class-map type control-plane match-any copp-stftp
  match access-group name copp-system-acl-stftp
class-map type control-plane match-any copp-tacacsradius
  match access-group name copp-system-acl-tacacsradius
class-map type control-plane match-any copp-telnet
  match access-group name copp-system-acl-telnet

policy-map type control-plane copp-system-policy 
  class copp-s-default
    police pps 400 
  class copp-s-l2switched
    police pps 200 
  class copp-s-ping
    police pps 100 
  class copp-s-l3destmiss
    police pps 100 
  class copp-s-glean
    police pps 500 
  class copp-s-selfIp
    police pps 500 
  class copp-s-l3mtufail
    police pps 100 
  class copp-s-ttl1
    police pps 100 
  class copp-s-ipmcmiss
    police pps 400 
  class copp-s-l3slowpath
    police pps 100 
  class copp-s-dhcpreq
    police pps 300 
  class copp-s-dhcpresp
    police pps 300 
  class copp-s-dai
    police pps 300 
  class copp-s-igmp
    police pps 400 
  class copp-s-eigrp
    police pps 200 
  class copp-s-pimreg
    police pps 200 
  class copp-s-pimautorp
    police pps 200 
  class copp-s-routingProto2
    police pps 1300 
  class copp-s-v6routingProto2
    police pps 1300 
  class copp-s-routingProto1
    police pps 1000 
  class copp-s-arp
    police pps 200 
  class copp-s-ptp
    police pps 1000 
  class copp-s-vxlan
    police pps 1000 
  class copp-s-bfd
    police pps 600 
  class copp-s-bpdu
    police pps 12000 
  class copp-s-dpss
    police pps 1000 
  class copp-s-mpls
    police pps 100 
  class copp-icmp
    police pps 200 
  class copp-telnet
    police pps 500 
  class copp-ssh
    police pps 500 
  class copp-snmp
    police pps 500 
  class copp-ntp
    police pps 100 
  class copp-tacacsradius
    police pps 400 
  class copp-stftp
    police pps 400 

control-plane
  service-policy input copp-system-policy
Improve this answer
2
  • but nexus 3k does not allow us to use our own customized profile, so I want to know if u use system qos type input , do I have same result?
    – Blackmetal
    Commented Jun 6, 2023 at 8:09
  • That IS from a 3064. Any bit of that can be tweaked as I wish.
    – Ricky
    Commented Jun 6, 2023 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.