Dell EMC SmartFabric OS10 User Guide Release 10.5.0

Control-plane policing

Control-plane policing (CoPP) increases security on the system by protecting the route processor from unnecessary traffic and giving priority to important control plane and management traffic. CoPP uses a dedicated control plane configuration through the QoS CLIs to set rate-limiting capabilities for control plane packets.

If the rate of control packets towards the CPU is higher than the packet rate that the CPU can handle, CoPP provides a method to selectively drop some of the control traffic so that the CPU can process high-priority control traffic. You can use CoPP to rate-limit traffic through each CPU port queue of the network processor (NPU).

CoPP applies policy actions on all control-plane traffic. The control-plane class map does not use any match criteria. To enforce rate-limiting or rate policing on control-plane traffic, create policy maps. You can use the control-plane command to attach the CoPP service policies directly to the control-plane.

Starting from release 10.4.2, the default rate limits have changed from 12 CPU queues and the protocols mapped to each CPU queue are changed.

NOTE When you upgrade from a previous release to release 10.4.2 and you have CoPP policy with rate limits configured in the previous release, the CoPP policies are automatically remapped based on the new CoPP protocol mappings to queues. For example:

You have a CoPP policy configured for queue 5 in release 10.4.1, which is for ARP Request, ICMPv6-RS-NS, iSCSI snooping, and iSCSI-COS.
After upgrade to release 10.4.2, the CoPP policy for queue 5 is remapped based on the new CoPP protocol mappings to queues as follows:
- ARP Request is mapped to queue 6
- ICMPv6-RS-NS is mapped to queue 5
- iSCSI is mapped to queue 0
  The rate limit configuration in CoPP policy before upgrade is automatically remapped to queues 6, 5, and 0 respectively after upgrade.

For example, in release 10.4.1, the following policy configuration is applied on queue 5, which in 10.4.1 is mapped to ARP_REQ, ICMPV6_RS, ICMPV6_NS, and ISCSI protocols:

policy-map type control-plane test
!
class test
  set qos-group 5
  police cir 300 pir 300

After upgrade to release 10.4.2, the policy configuration appears as follows:

policy-map type control-plane test
!
class test_Remapped_0
  set qos-group 0
  police cir 300 pir 300
!
class test_Remapped_5
  set qos-group 5
  police cir 300 pir 300
!
class test_Remapped_6
  set qos-group 6
  police cir 300 pir 300

In release 10.4.2, ARP_REQ is mapped to queue 6, ICMPV6_RS and ICMPV6_NS are mapped to queue 5, and ISCSI is mapped to queue 0.

By default, CoPP traffic towards the CPU is classified into different queues as shown below.

Table 1. CoPP: Protocol mappings to queues - prior to release 10.4.2CoPP queues
Queue	Protocol
0	IPv6
1	—
2	IGMP
3	VLT, NDS
4	ICMPv6, ICMPv4
5	ARP Request, ICMPV6-RS-NS, ISCSI snooping, ISCSI-COS
6	ICMPv6-RA-NA, SSH, TELNET, TACACS, NTP, FTP
7	RSTP,PVST, MSTP,LACP
8	Dot1X,LLDP, FCOE-FPORT
9	BGPv4, OSPFv6
10	DHCPv6, DHCPv4, VRRP
11	OSPF Hello, OpenFlow

The following table lists the CoPP protocol mappings to queues, and default rate limits and buffer sizes on the S4148FE-ON platform. The number of control-plane queues is dependent on the hardware platform.

Table 2. CoPP: Protocol mappings to queues, and default rate limits and buffer sizes - from release 10.4.2 and laterCoPP: Protocol mappings to queues, and default rate limits and buffer sizes - from release 10.4.2 and later
Queue	Protocols	Minimum rate limit (in pps)	Maximum rate limit (in pps)	Minimum guaranteed buffer (in bytes)	Static shared limit (in bytes)
0	Unresolved, iSCSI, IPv6	600	600	1664	20800
1	SFlow	1000	1000	1664	20800
2	IGMP, MLD, PIM control	400	400	1664	48880
3	VLT, NDS	600	1000	1664	48880
4	IPv6 ICMP, IPv4 ICMP	500	500	1664	20800
5	ICMPv6 RS, RA, NS, NA	500	500	1664	48880
6	ARP request	500	1000	1664	48880
7	ARP response	500	1000	1664	48880
8	SSH, TELNET, NTP, FTP, TACACS	500	500	1664	20800
9	FCoE	600	600	1664	48880
10	LACP	600	1000	1664	48880
11	STP, RSTP, MSTP	400	400	1664	48880
12	DOT1X, LLDP	500	500	1664	48880
13	IPv6 OSPF	600	1000	1664	48880
14	IPv4 OSPF	600	1000	1664	48880
15	BGP	600	1000	1664	48880
16	IPv4 DHCP, IPv6 DHCP	500	500	1664	48880
17	VRRP	600	1000	1664	48880
18	BFD	700	700	1664	48880
19	Remote CPS	700	1000	1664	48880
20	MCAST data	300	300	1664	20800
21	ACL logging	100	100	1664	20800
22	MCAST known data	300	300	1664	20800

For information about the current protocol to queue mapping and the rate-limit configured per queue, see show control-plane info.

Welcome

Welcome to Dell

Dell EMC SmartFabric OS10 User Guide Release 10.5.0

Control-plane policing

Rate this content