3

I have a N5K-5672UP with enterprise license and I execute these commands to protect my control plane :

control-plane
service-policy input copp-system-policy-default

There is 2 issues:

  1. When I execute show run copp it does not show anything and even when I check whole of the show run with my eyes there is no copp config.
  2. when I send TCP syn attack towards my control plane my CPU usages is around %20-30 but my bgp session goes down and I can enter command slowly, whats wrong?

here is show copp status output: show copp status

Last Config Operation: service-policy input copp-system-policy-default
Last Config Operation Timestamp: 08:51:29 GMT Nov 21 2021
Last Config Operation Status: Success
Policy-map attached to the control-plane: copp-system-policy-default

Thank you.

3
  • Can you verify using tcpdump if those attack packets reach their destination?
    – manish ma
    Nov 21 '21 at 6:21
  • yes i did and they reached. here is sample of the packets: 2021-11-21 09:29:43.453886 62.210.177.101 -> 5.x.x.x TCP www > 3020 [SYN, ACK] Seq=0 Ack=0 Win=29200 Len=0 MSS=1460 2021-11-21 09:29:43.453945 50.97.86.116 -> 5.x.x.x TCP www > 29635 [SYN, ACK] Seq=0 Ack=0 Win=29200 Len=0 MSS=1460 2021-11-21 09:29:43.454011 104.83.32.230 -> 5.x.x.x TCP www > 63267 [SYN, ACK] Seq=0 Ack=0 Win=64240 Len=0 MSS=1460 2021-11-21 09:29:43.454059 185.91.165.139 -> 5.x.x.x TCP www > 59053 [SYN, ACK] Seq=0 Ack=0 Win=4380 Len=0 MSS=1460
    – Blackmetal
    Nov 21 '21 at 6:30
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 24 '21 at 0:17
0

According to https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/security/513_n1_1/b_Cisco_n5k_security_config_gd_513_n1_1/b_Cisco_n5k_security_config_gd_513_n1_1_chapter_01101.html#con_1085200

Default policy applies the following policer configuration:

policy-map type control-plane copp-system-policy-default
    class copp-system-class-igmp
      police cir 1024 kbps bc 65535 bytes 
    class copp-system-class-pim-hello
      police cir 1024 kbps bc 4800000 bytes 
    class copp-system-class-bridging
      police cir 20000 kbps bc 4800000 bytes 
    class copp-system-class-arp
      police cir 1024 kbps bc 3600000 bytes 
    class copp-system-class-dhcp
      police cir 1024 kbps bc 4800000 bytes 
    class copp-system-class-mgmt
      police cir 12000 kbps bc 4800000 bytes 
    class copp-system-class-lacp
      police cir 1024 kbps bc 4800000 bytes 
    class copp-system-class-lldp
      police cir 2048 kbps bc 4800000 bytes 
    class copp-system-class-udld
      police cir 2048 kbps bc 4800000 bytes 
    class copp-system-class-isis
      police cir 1024 kbps bc 4800000 bytes 
    class copp-system-class-msdp
      police cir 9600 kbps bc 4800000 bytes 
    class copp-system-class-cdp
      police cir 1024 kbps bc 4800000 bytes 
    class copp-system-class-fip
      police cir 1024 kbps bc 4800000 bytes 
    class copp-system-class-bgp
      police cir 9600 kbps bc 4800000 bytes 
    class copp-system-class-eigrp
      police cir 9600 kbps bc 4800000 bytes 
    class copp-system-class-exception
      police cir 64 kbps bc 4800000 bytes 
    class copp-system-class-glean
      police cir 1024 kbps bc 4800000 bytes 
    class copp-system-class-hsrp-vrrp
      police cir 1024 kbps bc 256000 bytes 
    class copp-system-class-icmp-echo
      police cir 64 kbps bc 3600000 bytes 
    class copp-system-class-ospf
      police cir 9600 kbps bc 4800000 bytes 
    class copp-system-class-pim-register
      police cir 9600 kbps bc 4800000 bytes 
    class copp-system-class-rip
      police cir 9600 kbps bc 4800000 bytes 
    class copp-system-class-l3dest-miss
      police cir 64 kbps bc 256000 bytes 
    class copp-system-class-mcast-miss
      police cir 256 kbps bc 3200000 bytes 
    class copp-system-class-excp-ip-frag
      police cir 64 kbps bc 3200000 bytes 
    class copp-system-class-excp-same-if
      police cir 64 kbps bc 3200000 bytes 
    class copp-system-class-excp-ttl
      police cir 64 kbps bc 3200000 bytes 
    class copp-system-class-default
      police cir 512 kbps bc 6400000 bytes 

So, if I understood your PCAP correctly, you simulate HTTP traffic - which is not part of this policy.

Maybe you should configure a custom policy that applies policing to TCP traffic in general. If that is what you want.

And I think that you don't see it in configuration because it is the default policy.

3
  • Do you have any example for that ? or guide me how can I add a policy like that?
    – Blackmetal
    Nov 21 '21 at 7:49
  • To be honest. I'm not familiar with Nexus at all. I just have some knowledge regarding DDOS attack mitigation in general. I would look in the link I attached to the above answer. They mention something about TCP SYN protection there. Ideally you should find a rule that matches TCP SYN packets specifically. I saw that there is a rule to match mgmt traffic (you can see it in the above default policy), that also limits HTTP traffic in general - you can try it with a more aggressive policer configuration (e.g. cir 1kbps - and to see how it affects the system) but it is not exactly what you want
    – manish ma
    Nov 21 '21 at 7:54
  • 2
    Also, from the document: " The Cisco NX-OS device supports only hardware-based CoPP which does not support the management interface (mgmt0). The out-of-band mgmt0 interface connects directly to the CPU and does not pass through the in-band traffic hardware where CoPP is implemented. On the mgmt0 interface, ACLs can be configured to give or deny access to a particular type of traffic. " So if you want to protect from DDOS arriving on mgmt interface, use ACL
    – manish ma
    Nov 21 '21 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.