Hello, I have read cisco's doc about cpp and i've also read the good documentation written by John Kristoff about cpp in wich are included some implementation example. I do some test in our lab environment, a GSR 12410 with IOS 12.0(32)S2 but i'm not satisfied with the result. Suppose this sample conf: access-list 168 permit icmp any loopback0 0.0.0.0 access-list 169 permit any class-map cp-icmp match access-group 168 class-map cp-default match access-group 169 policy-map cp-traffic class cp-icmp police 8000 conform-action transmit exceed-action drop class cp-default priority control-plane service-policy input cp-traffic Then i ping from a host or a router the loopback0 and i noticed that only if i set an MTU or packet size > 1500, in fact 1480 so with the standar ip header is always 1500, the policy take effect. In fact if i issue the sh policy-map control-plane with small packet size all traffic seems to be matched by the cp-default class: Service-policy input: cp-traffic (225) Class-map: cp-icmp (match-all) (4925921/1) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: access-group 168 (15210210) police: cir 8000 bps, bc 4470 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop conformed 0 bps, exceed 0 bps Class-map: cp-default (match-all) (14530241/2) 151 packets, 11967 bytes 5 minute offered rate 2000 bps, drop rate 0 bps Match: access-group 3 (1872818) Class-map: class-default (match-any) (9318433/0) 3149 packets, 333931 bytes 5 minute offered rate 1000 bps, drop rate 0 bps Match: any (4397474) Instead with a greater size: Class-map: cp-icmp (match-all) (4925921/1) 22 packets, 16896 bytes 5 minute offered rate 2000 bps, drop rate 0 bps Match: access-group 168 (15210210) police: cir 8000 bps, bc 4470 bytes conformed 20 packets, 13888 bytes; actions: transmit exceeded 2 packets, 3008 bytes; actions: drop conformed 2000 bps, exceed 0 bps Is there anyone with some idea or anyone that can share experience with me ? Thanks Gianluca Italy
On Thu, 01 Jun 2006 12:07:00 +0200 hjan <hjan@libero.it> wrote:
I have read cisco's doc about cpp and i've also read the good documentation written by John Kristoff about cpp in wich are included some implementation example.
The cisco-nsp mailing list is probably a better place for anything specific to Cisco's CoPP, but I'll quickly respond here, because the issue is general enough and others might be interested. You might be interested in reviewing a brief talk I did at the last Joint Techs. I went over some of the experiences and lessons learned: <http://events.internet2.edu/2006/jt-albuquerque/sessionDetails.cfm?session=2444&event=243> Note, the title is Tripping on QoS, but there is CoPP stuff in there. Unfortunately I don't think the session was audio or video recorded. A key point I'd like to make since I originally wrote that page is that it is quite difficult, and probably not the best approach, to use a control plane policy where you end up shovelling any unmatched stuff into a general rate limiter. Phil Rosenthal probably has the right idea to specifically pass things you know you want, maybe rate limiting them, but then have a default deny.
access-list 168 permit icmp any loopback0 0.0.0.0
That doesn't look right. You do not need to specify a loopback address. By definition, the control plane policy will apply to any router interface, so perhaps you meant to say something like this: access-list 168 permit icmp any any Although I'm not sure I'd recommend doing what you're doing except for testing purposes. You have to think very carefully about what could happen when you start rate limiting protocols generally. For example, if something ICMP floods your router, will your network availability monitoring system's traffic get starved out? John
participants (2)
-
hjan -
John Kristoff