CoPP

Control Plane Policing

CoPP is a network security and Quality of Service (QoS) feature used on routers and switches (commonly Cisco devices) to protect the device's control plane CPU from excessive or malicious traffic.

Configuration

Step 1: Identify the Traffic (Access Control Lists)

! Match SSH management traffic
ip access-list extended ACL-COPP-SSH
 permit tcp any any eq 22

! Match ICMP (ping) traffic
ip access-list extended ACL-COPP-ICMP
 permit icmp any any

Step 2: Classify the Traffic (Class Maps)

! Create a class map for SSH
class-map match-all CM-COPP-SSH
 match access-group name ACL-COPP-SSH

! Create a class map for ICMP
class-map match-all CM-COPP-ICMP
 match access-group name ACL-COPP-ICMP

Step 3: Act on Traffic (Policy Map)

policy-map PM-COPP-POLICY
 
 ! Allow SSH traffic up to 256 kbps, transmit normally, drop excess
 class CM-COPP-SSH
  police 256000 8000 conform-action transmit exceed-action drop
 
 ! Strictly limit ICMP traffic to 64 kbps to prevent flood attacks
 class CM-COPP-ICMP
  police 64000 2000 conform-action transmit exceed-action drop
 
 ! Optional: Catch-all for any other control plane traffic (OSPF, BGP, etc.)
 class class-default
  police 1000000 12000 conform-action transmit exceed-action drop

Step 4: Apply to the Control Plane

control-plane
 service-policy input PM-COPP-POLICY