As we turn our attention to the control plane policing feature that can help
protect our infrastructure devices,
let's leave our infrastructure ACL inbound that we created previously right
here. So currently,
server one dash nug can get to our one at 25 dot 25 dot 25 dot one. And we can
log in as admin using
SSH and that works because the infrastructure ACL is letting it. So as an
additional level of
protection regarding access to router one via SSH, we could also go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
protection regarding access to router one via SSH, we could also go ahead and
use control plane
policing. And here's the three elements of control plane policing. Number one,
identify the traffic,
which is done with an access control list in combination with a class map. So
that's step number
one. So step number two would be to go ahead and identify what actually want to
take on that traffic.
And that is specified with a policy map. And that policy map is calling upon
the class map to
identify what traffic to take that action upon. So let's imagine the access
control list and the
class map are looking for SSH traffic. And then in the policy map, what we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
class map are looking for SSH traffic. And then in the policy map, what we
could say is we could
limit that traffic to a certain amount, or we could just go ahead in the policy
map and say,
if we see it, drop it. And then the third step is to specify where we want to
apply effectively
that policy map. So step number three is where to apply it. And in the case of
control plane
policing, we want to apply it to the control plane. Like think of that, like
logically inside the
brains of the router itself. So no matter where that traffic comes in, if it's
coming in here,
or here, or here, once it's logically received here at the control plane, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or here, or here, once it's logically received here at the control plane, we
can go ahead with
the service policy command, apply that policy map, and tell it to go ahead and
effectively drop
SSH if it sees it. So the command to implement the policy map on the control
plane is a command
called service policy. And as part of that, we'd refer to the policy map that
we created earlier.
So to demonstrate this, let's go ahead and use the R one, which is currently
receiving
SSH connections over here from server one. And let's go ahead and configure
control plane
policing. So if R one sees that someone is trying to SSH in, it'll go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
policing. So if R one sees that someone is trying to SSH in, it'll go ahead and
drop it. Now,
we also have other mechanisms for controlling that we could say on the VTY
lines where people
might be trying to come in, we could deny, for example, tell net SSH there, we
could also apply
access control list that each of the interfaces, but using control plane
policing makes it really
convenient no matter where that traffic is coming in from to go ahead and drop
it. So let me walk
you through that right now. In fact, we should start by just still verifying
that this server
right here can currently SSH over to R one at 252525.1. So let's do that one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right here can currently SSH over to R one at 252525.1. So let's do that one
first. So back in the lab
here at server one, let's go ahead and go back to server one, which is right
here. And let's bring
up a command prompt. And let's do SSH press center. And just to remind
ourselves, we're doing an
SSH space that see, and that cipher is going back to our one that cipher was
this one right here,
AES 128 CBC. So I'll copy that we'll go back to the command prompt. And we'll
right click to
paste that in space admin 25 dot 25 dot 25 dot one. So I verify before we start WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
paste that in space admin 25 dot 25 dot 25 dot one. So I verify before we start
training control
plane policing that it still works at the moment. So we'll log in as admin,
supply the password,
and we're good to go. So we type in who and show SH, we're good to go. So I'll
type in exit,
and we'll minimize that because we're going to try that again here in a little
bit. So now if
you go to our one, which a moment ago was allowing that inbound SSH connection,
let's go ahead and
create an access control list that identifies SSH traffic. So we'll do a config
T. And let's do a
named access list IP access dash list extended, and let's call this ACL dash WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
named access list IP access dash list extended, and let's call this ACL dash
match dash SSH. We know
exactly what this access control list is going to be doing. And for it, we'll
simply say permit
TCP any, any equals port 22. So there it is, our one entry in this access
control list. So we do a
do show access list for that specific ACL and press enter, it has one exact
entry and it's line
number 10 right there. Fantastic. So the access control list is looking for TCP
and layer four WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and layer four
going from anywhere to anywhere, if the destination port is 22. And then a
doesn't match this is going
to be an implied deny, meaning not matching this access control list. Let's
type in exit and we'll
exit configuration mode for that access control list. Next, let's create a
class map that calls
upon that access control list. And to do that, we'll type in class map space.
And then we have a
match any or match all. And since we're only matching on one specific access
control list,
we could actually use match any or match all because we're only looking for one
specific match
anyway. So I'm gonna say match all space question mark, and then the name. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
anyway. So I'm gonna say match all space question mark, and then the name. So
we now have this new
class map. And now we need to tell it what to match on. Let's go ahead and do a
match space,
access group, and a space question mark. And it's the named access list. So we
'll go ahead and type
in namespace. And then the name of our access control list, which I'm going to
scroll up and
grab it right here ACL dash match dash SSH. And we'll press center. So now we
do a do show class map
and press center. We have a class map called CMAP dash SSH that's matching on
that ACL match SSH,
which is matching on TCP traffic from anywhere to anywhere. If the destination WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is matching on TCP traffic from anywhere to anywhere. If the destination
port is 22.
So that's the matching part regarding control plane policing. So the second
part is to go ahead
and say what we want to do with that traffic once we see it. So to do that, we
're going to create a
policy map. So in configuration mode, we'll type in policy map space. And let's
call it P map dash
SSH press enter. And we want this policy map to be applicable or applied to any
traffic that
matches class map C map dash SSH, which is matching on the ACL match SSH. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
matches class map C map dash SSH, which is matching on the ACL match SSH. So
long story short too late,
I know we're matching on traffic. This destined to part 22. And if we see it
here in the policy map
is where we specify the action. So as a demonstration, even though we have lots
of cool options,
I'd like to do a really obvious option of drop, meaning if I see it, I want to
drop it. So I'll type
in drop press center and it'll type in exit and exit. Let's do a do show policy
map. In fact,
let's take a look at everything. We'll do a do show access list and I'll type WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's take a look at everything. We'll do a do show access list and I'll type
it out so a nice and
clean ACL dash match dash SSH. That's identifying the traffic and the class map
that's calling upon
this is called CMAP dash SSH. So do a do show class map and press center. So
there's our class
map that we created right here. There's also a default class default class map
that's right here
matching on everything else. But the class map we created is just matching on
the ACL, which is
matching on SSH. Then our third piece is a do show policy map, we'll press
center. And this policy
map says if traffic matches this class map, then go ahead and drop it. Now WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
map says if traffic matches this class map, then go ahead and drop it. Now
currently, this policy
map is not applied anywhere. So we need to apply it and apply this to the
control plane. What we're
going to do is type in control plane and press enter. Now with the control
plane, there's also a
feature called control plane protection, not policing and control plane
protection allows us to go in
in any more granular fashion. So here for the control plane using control plane
policing to
apply the policy map with some type in service policy, then the direction we
want this for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
want this for
traffic coming into the control plane space and then the name of our policy map
, which is this bad
boy right there, pmap dash SSH. And it is done. We have just applied control
plane policing.
So we do a show policy map control plane and press enter. So there's the
command right there.
If it sees traffic matching the access control as match SSH, it's then going to
go ahead and take
the action of dropping it. And then for other traffic that doesn't match that
class map,
it's going to be permitted by default. So previously, we were able to SSH over WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's going to be permitted by default. So previously, we were able to SSH over
to R1,
but now check this out. Currently, we have a hit count of zero packets matching
that class map.
And now if we go back to the command prompt and hit the up arrow key and do
that same SSH once again,
even though the infrastructure ACL is allowing this to happen, the control
plane policing is not.
So that's going to timeout in a moment here. And while that's thinking about
life and waiting to
timeout, let's go back to R1 and let's hit the up arrow key and do a show
policy map control
plane again and check it out. Now it sees that there's five packets that match WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
plane again and check it out. Now it sees that there's five packets that match
that class map.
And as a result, the action was dropped. And because the class map is calling
upon the access
control list, we did a show access list here. And if we edited this, for
example, let's go into
configuration mode, I'll do an IP access list extended. And let's go ahead and
modify our access
control list and press enter. Let's add line five. So we'll put a five there to
put it above line 10.
And for line number five, which will come first, if we said deny TCP coming
from 192.168, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
from 192.168,
I should probably use the host keyword and say myself some typing, deny TCP
coming from host 23.1.2.100,
going to host. And let's go ahead and say it's host by five dot 25 dot 25 dot
one and press enter.
So now if you look at our access control, so the show access list and the name
of our ACL,
which I'll go ahead and copy and paste from right here, copy there, paste there
, press enter.
Now we have two entries. The first entry says deny so effectively because the
class map is
calling upon this access control list is saying deny meaning I don't care. I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
calling upon this access control list is saying deny meaning I don't care. I
don't want to match
for that stream of traffic. And then for the second entry entry 10 is still
looking for anything else
any TCP traffic. So effectively that means that our policy map, which is
applied to the control
plane is not going to care, not going to match on traffic going from our server
to to our one
at that address. And as a result of it not matching the control plane drop
action is not going to
take effect. So if we go back to the command prompt here and we hit the after a
keyword just a moment
to go failed, now it should succeed. So it's less against the login. So we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to go failed, now it should succeed. So it's less against the login. So we'll
put it on our password
press center and we are good to go. And the value is we can do a show policy
map control plane back
at our one and notice there's no additional packets that have matched anybody
do a show access list
and press center. We now have some hits on that line five. So the deny says don
't match or don't
care about matching. And that's why the SSH sessions are now beginning to work.
So with control plane
policing, one of the features is to drop specific traffic that we're matching
on. But another option
is to go ahead and allow traffic up to a certain threshold and then throttle it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is to go ahead and allow traffic up to a certain threshold and then throttle it
, which can also help
protect against a denial of service attack against a router. So in the next
video, I'd like to walk
you through one more example of setting up control plane policing. But this
time using a threshold
to limit certain traffic above a certain point. So I'll see you in the next
video in just a moment.