As part of control plane policing,
we've done two of the three major parts.
Number one, we created class-maps to identify traffic,
two, we created policy maps to say
what we're going to do if we see that traffic, like police it,
and the third step, and what we're
going to focus in this video is how
we apply that policy to the control plane.
[MUSIC PLAYING]
So as we go back to the CLI picking up where we left off,
I'm looking at my text document, and I realized that, hey, we
talked about the policy maps, but I'm looking at the CLI. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
talked about the policy maps, but I'm looking at the CLI.
I haven't applied them, so let me go ahead
and apply the policy map to the configuration.
Also at the end of the policy map,
I've got this class, class default,
which is all the other traffic that
didn't match somewhere else, and I'm also policing that.
You know what?
Let's do this.
Let me go ahead and specify that for the class class
default, everything else that didn't match,
I don't want to drop it.
I want to go ahead, and I want to say conform action transmit,
exceed action transmit, and violate action transmit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
exceed action transmit, and violate action transmit.
I just want to go ahead and allow everything else that
wasn't matched explicitly to go ahead and be allowed through.
Then we can still see it.
So that's a small change we're going to make there
for that final one.
Let me go ahead and copy this.
Right click, Copy, and then, I'll
just go ahead and right click, and we'll put that in on R1.
And our last step is to apply that policy map
to the router using this service policy command,
and to do that, here is the syntax.
Instead of going to the interface-- in fact, let's look WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Instead of going to the interface-- in fact, let's look
at our topology-- instead of going to interface 1 0 or 2 0,
we want to protect this box on any of those matched traffic
patterns from the class-maps regardless
of how that traffic comes in.
And so what we can do is we can logically apply this policy
map to the control plane, a logical entity on this router
called literally control dash plane.
And here's how we do it.
We'd go into control plane configuration mode
just by typing in control dash plane,
and then, we'd use the command service dash policy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then, we'd use the command service dash policy
input and then the name of our policy,
and it does need to be case correct.
So we did upper and lower case respectively.
You will want to use that same exact name.
So let me go ahead and copy that, and I'll paste it in.
So to see our policy, we'd use this command right here--
show policy dash map control dash plane space input.
And so I'll copy that, and we'll paste that in,
and here is our policy, and it's simply showing you
in order based on each of the class-maps
and what's happening.
So for the ICMP class, there looks like there's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for the ICMP class, there looks like there's
been no traffic yet.
If we go down a little bit further,
there's no IPSec running so there's no IPSec traffic.
Management class, there's no management traffic
that's been matched yet.
Oh, check this out though.
Good news.
The routing class-- look at this.
We've had six packets, 564 bytes,
and we have six packets that conformed,
and we haven't had any packets that
have exceeded that, and that's because I have OSPF running,
and that's one of the ACLs used in the class-map,
and we're looking for 224 0 0 5
If you want to see-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If you want to see--
this is also pretty cool--
let me do a show access list.
Look at this.
This will show us the access list
and the hit counts for there, too.
So right here, here we have OSPF 224 0 0 5.
That address was hit, and it looks
like we don't have any hits on anything else.
Now, the goal-- let's talk about the goal of control plane
policing.
We're trying to protect the router.
So if something goes wacky or somebody starts
attacking with control plane traffic at this router,
then it can start shedding that off
and not just consume the entire CPU.
So as a test, here's what I'd like to do. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So as a test, here's what I'd like to do.
We have the control plane policing set up on R1,
and we do not have control plane policing set up on R2.
So let's go to R3, and let's do a ping, to 1 1 1 1,
and let's go ahead and hit it with a size of 500 and a wait
time of 0, which is--
it turns your router basically into a DOS machine
because it's just going to send those ping packets as
fast as it can spit them out.
It's not going to wait anything for a response,
and let's also send a million that way
it'll just keep on going. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it'll just keep on going.
So we'll do that from R3 against R1,
and to kind of make it fair, let's also
do the same thing against R2, and we'll do that from R4.
So we'll ping with a size of 500, a wait time of 0,
and we'll send a million.
And the benefit of doing that is that what
should happen on R1, because it's
got control plane policing, it's going to be just swatting
a bunch of that traffic down and doesn't have
to process them as a result.
It's just killing them where R2 is taking
every packet that comes in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
every packet that comes in.
It has to process it, and so we should see that CPU on R2
is going up, up, up, up, up where
on R1, it's going to kill a lot of that traffic because
of the control plane policing that we just implemented,
and the CPU should stay-- it should go up a little bit,
but it shouldn't be nearly as high as R2
with the same exact load of traffic.
So with that plan in place, let's go ahead and test it.
So back at the CLI, let's go to R3.
We'll set this up first with going to R1.
So we'll do a ping to 1 1-- let's
make sure I have the route.
That'd be good, too.
Show IP route. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Show IP route.
Yep, so it's got to route to 1 1 1, that's R1.
So we'll do a ping to 1.1.1.1 and for our repeat,
let's go ahead and do a million, and this also for size,
let's go ahead and do 500, and I won't press enter yet.
We're going to do the same thing, but on R4 over to R2.
So let me just copy those parts there.
We'll make a road trip over to R4,
and we'll do a ping to 2.2.2.2 space,
and I'll paste in the rest.
Fantastic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Fantastic.
And then we'll just launch them.
So that's going to--
oh, you know what?
Dang.
Stop that.
Control shift 6.
Stop.
OK.
And I want a time out of zero.
That's exactly what I want, and then we'll go back to R3,
and we'll do the same thing.
And then we'll launch them both, so we'll launch that one,
and we'll launch that one, and we
may see a ping occasionally sneak in there
or a response come in.
It's just hammering out pings as fast as it can.
So let's go to R1, and on R1, if we do a show access list, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's go to R1, and on R1, if we do a show access list,
we should have a whole bunch of matches there, which we do.
And if you do a show policy map control plane input,
here it's showing us that we have a whole bunch of traffic
that has not conformed to the 8,000 bits per second,
and let's do a show process CPU.
It looks like I lost a neighborship.
All right.
So if we do a show process CPU there, and on R2,
we do a show process CPU, and I lost a neighborship there, too,
so we're going to lose some routing here in a moment.
Anyway, the point I wanted to show you
was that on R1, look at the 1 minute average here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
was that on R1, look at the 1 minute average here.
It's like 2%.
And on R2, it is a 1 minute average of 6%,
and that's going to keep on getting
worse and worse and worse.
Now, the reality is, behind the scenes,
if we lose our OSPF neighborships because of all
the bandwidth that we're using and so forth, unfortunately,
we're going to lose reachability to the loop back addresses,
which is going to decrease the load.
So if we want to this again-- in fact,
let's do it-- let's do it a little bit differently.
Let's go back to R3, and do a Control-Shift-6 to stop that, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's go back to R3, and do a Control-Shift-6 to stop that,
and we'll do the same thing on R4, Control-Shift-6.
And let's do that again, but let's do it
to the actual interface.
So on R4, it's going to be--
hmm, let's do this.
We'll do a Control-- let's see, let's do a show CDP neighbor.
OK.
So from R4's perspective, R2 is going
to show IP interface brief on gig 2/0.
OK.
It's going to be 24.2 is the local interface.
So if we did that same ping, but we did up to 10.0.24.2 that way WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we did that same ping, but we did up to 10.0.24.2 that way
we won't lose the route If we lose OSPF,
and that way we can have a good test that continues on.
So 10.0.24.2.
I won't press Enter yet.
And then over on R3, we'll hit the upper key,
and that's going to be 10.0.13.1,
and we'll let that run.
All right.
That's important because if we lose the loop back,
and then we don't have route reachability,
those pings are not being sent, and then, we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
those pings are not being sent, and then, we're
not loading up on the CPUs.
So if we go back to R1, and we do a show process CPU,
and it has a 1 minute average of 2%.
And then if we go to R2, and the same command show process CPU,
it's got a 1 minute average of 4%,
and that is going to go higher and higher.
So the control plane policing that we are doing on router 1
is actually protecting it from having
its CPU have to process all of those ICMP messages
because he's just knocking down a ton of them
because of the control plane policing policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because of the control plane policing policy.
[WHOOSH]
So I've got this lab set up for you to do from soup to dessert.
If you're logged on from a computer
to the CBT Nuggets website, you click on the link
for our virtual lab.
On the desktop, I have these commands
that we did in this video, and what
you can do is you can apply them to any router you like,
one, two, three, or four, and as you apply those,
you can do them step by step as we
did in the subsequent videos.
You can do them all at once, you can do them manually
if you want to get the hands on practice
in both configuring class-maps, policy maps,
and then applying the policy map to the control plane using WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then applying the policy map to the control plane using
the service policy command.
So have some fun and some hands on practice
if you'd like in both configuring and verifying
control plane policing on a Cisco router.
So thanks for joining me.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.