To implement control plane policing,
we're going to use a very structured approach that's
referred to as the MQC.
That's the Modular Quality of Service Command-Line Interface,
and it's fantastic for implementing COPP as well.
[MUSIC PLAYING]
Our objective is to implement some control plane policing
so that traffic like routing updates or ICMP messages
or other things that the routers themselves
have to process using a lot of CPU,
so we can temper that or set limits for it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so we can temper that or set limits for it
so that we can cap it off before it becomes
a real problem for the router.
Now in that process, we're going to use something called
the MQC, which is an acronym for the Modular Quality of Service
Command-Line Interface.
This is created originally to implement
QoS, quality of service.
However, it's also a fantastic, logical structure
to implement control plane policing as well.
And it has three basic parts of MQC, and that's this.
Number one, we want to identify the traffic that we
want to manipulate or control. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
want to manipulate or control.
So in the case of control plane policing,
some of the traffic that we might want to put caps on
are routing updates or routing protocols.
We might want to do ICMP.
Perhaps we're supporting IPsec on some of these devices,
and we might want to set some caps regarding how much IPSec
we're willing to process because we could have an attacker,
and maybe they're trying to do thousands of IPsec sessions
with our router that's supporting VPNs,
and that could just bring our router to a standstill
with that type of attack.
Let's put some caps on it.
Other traffic that we might want to monitor or control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Other traffic that we might want to monitor or control
could be SSH, and these are all examples of control plane
traffic that the router would have
to spend an inordinate amount of CPU to go ahead and process.
So as part of MCQ, the first access or the first idea
is to identify the traffic that we want
to go ahead and manipulate.
Now in MQC, this is done with something called a class-map.
So whenever you see a class-map, I want you to think of,
oh, we're simply identifying a certain class or a certain type
of traffic, and a class-map can call on lots of other tools WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of traffic, and a class-map can call on lots of other tools
to help it identify traffic including an access control
list.
So we could have an access control list that's
looking for specific routing protocols such as OSPF
and its multicast addresses or looking for ICMP
or looking for the protocols and [INAUDIBLE] by IPSec,
and we could do that in an ACL, and that ACL could
be called upon in a class-map.
So the first step is to identify the traffic,
and we're usually going to do that
with some type of a class-map including an ACL
to identify the traffic.
The second thing in the Modular Quality of Service CLI WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The second thing in the Modular Quality of Service CLI
is that we want to say what we want to do with that traffic.
So let's imagine that our class-map identifies
these four categories of protocols,
and what do we want to do?
That's the second step, and we may want to police.
In the case of control plane policing,
that's exactly what we're going to do.
So policing refers to limiting or putting a cap on.
So we can say, OK, we want this many bits per second
of certain types of traffic.
Anything above that, we want to go ahead and drop,
or we may allow a little bit of bursting at times, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or we may allow a little bit of bursting at times,
but if it exceeds all that, we want to drop it,
and that protects the CPU on the router
because once that traffic gets to a certain cap,
we can drop it, and the CPU on the router
doesn't have to process those packets anymore,
or above a certain level.
And in Modular Quality of Service,
the way we're going to do that is just something
called a policy map, and here's the play by play.
The policy map is going to say what
we're going to do when we've matched
on certain types of traffic identified by the class-map.
So it's kind of like a combo.
The class-map says this is the traffic we're looking for, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The class-map says this is the traffic we're looking for,
and then the policy map says, OK,
this is what we're going to do when we see that traffic,
and in the case of control plane policing,
we're going to limit or police that traffic
to certain quantities.
And then the third aspect of MQC is where.
What do you mean, Keith, where?
Well, where do you want to apply that policy?
Do you apply that policy on an individual interface
on a router, and in the case of control plane
policing, instead of applying that policy
to a specific interface or interfaces, what we could do
is we could apply it to a logical construct called WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is we could apply it to a logical construct called
the control plane.
And we apply it to the control plane,
and we're going to do that with a command called
service policy, and here's the bouncing ball.
The service policy is going to specify the policy map wherever
it's going to be applied, whether it's
to the logical control plane on this router or to an interface,
and then the policy map is calling on the class-map
to identify what traffic it's going to go ahead and act on.
So the benefit here is that instead of applying that policy
map to one of the interfaces or all of the interfaces,
we can apply it logically to the control plane, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can apply it logically to the control plane,
and then, anytime that traffic is matched,
it's going to go ahead and have this policy implemented,
and as a result, we can start policing traffic
if it gets above the specified limits we have
for the routing protocols or for ICMP
or IPSec or any other control plane traffic
that we've identified as part of that class-map that's
going to be manipulated.
So those are the three steps.
Class-maps to identify traffic, policy maps
to say what we're going to do to the traffic including policing,
and then the service policy specifies
where we're going to apply it.
In our example, we're going to apply it to the control plane. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In our example, we're going to apply it to the control plane.
So our next logical step is to go ahead and create
a class-map that's identifying specific traffic that we want
to control or police, and we'll do all that with a class-map
in the very next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.