In this video, I'd like to do a quick recap of Control Plane
Policing, its components, and what's in the mix,
and that way, if we have problems or issues with it,
we'll know what the ingredients are that we should
look at in troubleshooting it.
So let's use R1 as a guinea pig, and let's
take a look at the basic ingredients that
go into Control Plane Policing.
So this is the topology we're going to be using for our demo,
and here we're going to just take a look at R1
and the basic ingredients that go into making Control Plane WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the basic ingredients that go into making Control Plane
Policing work, which include Access Control List to identify
traffic, Class Maps, which use the access list as part
of identifying traffic, the policy maps
to say what we're going to do regarding
seeing that traffic and the limits
and then applying it to the actual control plane.
So in this demonstration, let's go to R1,
let's take a look at the syntax, and let's
verify some of the basics.
All right, so here on R1--
I'm on the management computer.
Let's just minimize the PuTTY session for a moment,
and I've got this document called CoPP Practice--
Control Plane Policing Practice.
Let me open that up, and I'm going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let me open that up, and I'm going
to make the font a little bit bigger so it's easier for us
to see.
I thought it would be interesting to look
at it from the bottom up, from the actual policy to the Class
Maps and then to the Access Control List.
Might be a good review of how it all works together.
So we've got this policy called CoPP-Policy,
which has been applied inbound on the logical control
plane of this router, or it will be once it's applied.
So this policy is calling upon Class Maps.
So these class maps-- we have one for ICMP,
Management Routing, and Class Default.
Once it calls one of those class maps,
it's then implementing limiting or controlling of how much WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's then implementing limiting or controlling of how much
traffic can go through based on the police statement
right here for each of those classes of traffic.
So we have the policy itself, and then we
have Class Maps, which are used as part of the policy.
And if we scroll up here, here we
have the definition of each of those classes.
We have one called ICMP Class, Management Class, Routing
Class, and it's matching on Access Control List
to help identify the traffic that belongs to that class.
So in this one called Management ACL, it's matching,
it looks like, on SSH sessions.
Great.
It's matching on Telnet sessions. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's matching on Telnet sessions.
Hopefully, there won't be too much Telnet in the production
environment.
It's looking for HTTP and HTTPS, and this guy right
here, that's SNMP.
So one of the challenges is, if we have set up
an access control list that's in a class map that's
part of a policy map and we aren't getting
the actual control or the matching
on those access control lists, we
can just do a Show Access List, and it
will show us the hit counts.
And then we won't have to guess, I wonder if this is being hit
or not.
It'll just show us.
And that's one of the great troubleshooting tips
is to look at the Access Control List counters,
see what's being hit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
see what's being hit.
So this is for remote access and SNMP as well,
and then this is for routing protocols.
So here we have BGP, and we have the dot-10 of the multicast,
which is used by EIGRP.
Dot-5 and dot-6 are for OSPF.
And then we have some multicast-related messages
for PIM and IGMP.
Now what this is not doing--
and I'd like to touch on it in this set of videos as well--
is, this is all IPv4.
So if you're running IPv6 and we want
to do matching on routing protocols for IPv6 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to do matching on routing protocols for IPv6
or we want do matching on remote access sessions with IPv6,
we would need to create some additional Access Control
Lists for IPv6 and include them as part of our policy.
So these are the basic ingredients
that go into Control Plane Policing,
including Access Control Lists, Class Maps, the policy maps,
then applying it.
And what I thought would be fun to do is,
I'm going to go ahead and apply this all to R1.
This is a little refresh from our previous set of videos
on Control Plane Policing.
So I'll do everything except for the Show command there.
So let me right-click on that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Copy.
Let's go back to our PuTTY session, and we'll go to R1.
And in R1, we'll right-click, and bada bing,
bada boom-- it's done.
[LAUGHS] It's done.
And then from here, we can do a Show Policy Map, Control Plane,
and I'm going to go ahead and just press
Enter for everything, and that's going
to show us our policy on the control plane.
So here's our policy.
There's the class maps.
It's also showing us if we have any matches or not.
Now, do we have any matches whatsoever?
[LAUGHS]
OK.
So, for troubleshooting, if we applied this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, for troubleshooting, if we applied this
and it had zero hits, zero matches,
we could say, wow, what's going on?
Why aren't we matching anything?
It's possible we don't have any traffic that's matching it.
So we could do this.
We could do Show Access List like that.
And see all these hit counters at the end?
[LAUGHS] There's none.
That means none of this traffic is being matched,
and that's very possible, because maybe we
don't have any ICMP traffic, NTP, or SSH,
or anything else going on, including routing protocols. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or anything else going on, including routing protocols.
Let's just show IP Protocols.
So in troubleshooting, it may be that we just
don't have that type of traffic on our network at the moment.
And as we proceed together, we'll add some traffic.
We'll get some Telnet traffic and SSH,
and we'll get some routing protocols.
So we can see those counters increase,
and we'll also have the opportunity
to do some troubleshooting when we think, hey,
why isn't this matching, to go ahead and investigate,
tweak it, and then include that in the correct Access Control
List, so we can do Control Plane Policing on that traffic
as well.
So in this video, we've taken a look WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in this video, we've taken a look
at a review of the Control Plane Placing
and the mechanisms that make it work.
And in the next video and lab, we'll
go ahead and implement it, and we'll
include some additional protocols
so we can see those counters increasing.
So I'll see you in that next video in just a minute.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.