As another example of using control plane policing, instead of having a router
drop traffic all the time, for example, if it's SSH or some other type of
traffic, let's go ahead and set up a threshold.
Now there's so many options we could do. Let's choose a fairly simple option
and that's with ICMP.
So to identify ICMP traffic with control plane policing, we're going to use an
access control list and we're going to use one class map that calls upon that
access control list, and then to specify that we want to do the throttling of
that traffic.
We're going to go ahead and create a policy map that specifies what we want to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to go ahead and create a policy map that specifies what we want to
do.
In this case, we'll allow a certain amount of ICMP traffic and then we'll go
ahead and throttle the rest, or meaning drop the excess of that traffic.
And the benefit of that is, if you have a denial of service attack against the
router, it can still process some of the ICMP if that's what we identify, but
over a certain point, you'll start dropping it and that'll protect the control
plane and the route processor from having to process all those packets.
The process some, but under attack, it won't have to be overwhelmed by
processing all of them. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then third, to apply it, we'll apply that to the control plane and that'll
be where we're applying it.
We do that with the service policy command.
So for the control plane, we'll go ahead and use service policy to apply the
policy map and that policy map is calling upon the class map and that class map
is calling upon the ACL to identify the traffic that we want to throttle.
So with that in mind, let's go ahead and walk through an example of setting up
ICMP throttling right here at router one.
And also, what would be really good as a test is let's go to our three and also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And also, what would be really good as a test is let's go to our three and also
our two and let's just hammer our one with a ton of ICMP traffic.
So from our three, we'll do a pinged 10 dot 0 13 dot one and from our two, we
'll do a pinged 10 dot 0 dot 12 dot one.
Then we'll tell it send a thousand by payload and also repeat like a million
times and we'll set a wait time of zero, which effectively make our routers
like a DOS machine just going to pump out at the best of their ability.
Thousands and thousands and thousands of those ping requests.
I'll try to hit R one.
In fact, our three and our two are going to be working so hard and pumping out WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In fact, our three and our two are going to be working so hard and pumping out
all those ping requests that we may actually lose our OSPF adjacencies between
our three and our one and our two and our one.
But that's okay. We'll just ping the local interfaces. So we don't have to
worry about reach ability via OSPF.
So let's do those pings first and let's see if the impact is here on our one.
So back in the lab environment, let's go to our one. Let's do a quick show of
the access control list that are in place.
And let's make another access control is just matching on ICMP traffic.
So we'll get a configuration mode and we'll create access list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
How about access this one on one fantastic and we'll say permit, meaning we
want to match on ICMP traffic from anywhere to anywhere.
Just as a simple example, then we'll create a class map. We'll call a C map
dash ICMP press enter.
Then we'll match on the access group and because the number of access control
list is one zero one, we'll press enter.
And now we have our first components regarding matching or matching with this
class map on any ICMP traffic, which would include ping traffic.
Oh, also, before we apply this, let's also go ahead and make sure we test our p WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Oh, also, before we apply this, let's also go ahead and make sure we test our p
ings.
So in fact, let me just pause for a moment. So here on our tool is to a ping to
10.0.12.1.
We'll say size is going to be a thousand and let's say the repeat is going to
be about 10.1,2,3.1,2,3.
That's 10 million space question mark and the timeout is going to be zero.
And before we press enter here, I'm going to go ahead and take that same
command and take it over to our three, paste it in.
But I want to go ahead and ping the local interface, which is 10.0.13.1 from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But I want to go ahead and ping the local interface, which is 10.0.13.1 from
the perspective of our three.
And before we press enter, let's go take a look at how our one is doing in
general.
So on our one, we'll go ahead and do a show process CPU press enter and then we
'll also, and then we'll filter a little bit more by doing a show process CPU
pipe.
And I only see the output where it shows CPU utilization for five seconds.
So I'll take and include CPU and upper case press enter.
Fantastic. So router one is pretty much sleeping right now. I'm not doing a
whole bunch of work.
So if we go to R2 and we launch the pings here, it's on its way and we go to R3 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we go to R2 and we launch the pings here, it's on its way and we go to R3
and we launch the pings there and it's on its way and give that a moment or two
.
We can just go back to R1 and if we hit the upper key now, CPU utilization
should be increasing.
So right there it's at 14/100 and the one minute average is going up.
And if we wait just a few more moments here, press enter.
So I'm going to wait 60 more seconds and let's make sure the pings are still
going and they are.
Also, we lost our OSPF adjacency from R2 and I'm expecting this one from R3.
And the reason for that is that R2 and R3 are so busy and staying out the pain WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the reason for that is that R2 and R3 are so busy and staying out the pain
requests that they're not able to maintain their OSPF adjacencies.
However, if we think of a look at the show process CPU include the output with
the line CPU and upper case,
you notice that our CPU utilization is going up and up and up.
So the one minute average is nine percent now.
It was four and then six and it's just going to keep on climbing.
And if we go back to R2 and R3, those pings are still being sent.
So after a few more moments here on R1, if we hit the upper key and press enter
, sure enough, we're increasing now our one minute average is ten. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
, sure enough, we're increasing now our one minute average is ten.
So that gives a representation of how the flooding here that we're doing with
ICMP can impact the route processors.
So I'll do a control shift six here on R2 and I'll also go to R3 and do a
control shift six here to stop it.
So now if we go back to R1 and we hit the upper key into a show process to CPU
and press enter, it should be settling down and it is.
So over a one minute and five minutes, those numbers will go down as well.
So if we want to protect R1 against ICMP floods, we could go ahead and create
control plane policing on it
and specify a threshold for ICMP at which point if it goes over the threshold, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and specify a threshold for ICMP at which point if it goes over the threshold,
it won't even bother processing the ICMP packets.
So let's do a show access list and take a look at how far we got. So here's our
access control list right here, 101 and we'll do a show class map.
And we have our class map ICMP, which is matching on access 101 and our third
step is to go ahead and create a policy map.
So we'll go back to the configuration mode, have been policy map and let's call
this P map dash ICMP and let's specify we're matching on the class called.
And let's just verify what that is real quick with the do show class map. So we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's just verify what that is real quick with the do show class map. So we
want to match on class C map dash ICMP.
So I'll put that in space question mark, press enter and now we get to specify
what we want to do when we see that traffic.
So previously, we did a drop with SSH if we see a safe will drop it.
But for this example, instead of dropping it, let's go ahead and police this
traffic.
So we'll type in police that traffic space question mark and we'll specify the
target bit rate. So we're going to say 8000 space question mark.
And if it conforms, meaning traffic is at 8000 bits per second or lower, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if it conforms, meaning traffic is at 8000 bits per second or lower, we
want the conform action to go ahead and be transmit for the exceed action.
We can see that the seed action to any of these and for the demo, let's go
ahead and do a drop.
And that way the route processor never asked to even work with those packets
that exceed that threshold space question mark and then the violate action will
also specify as.
Drop. So we do a do show policy map. Here's our policy map.
We have a policy map called P map dash ICMP. It's calling upon class map ICMP,
which is mapping over to the access control is 101. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is mapping over to the access control is 101.
And we're setting up a rate of 8000. So for the conform action, we are going to
transmit meaning we're going to process it.
But anything over that we're going to go ahead and drop. And then we need to
apply this class map.
And then to apply this, we'd go into the control plane. So we go ahead and copy
the policy map.
We're going to do that in just a moment. So we'll exit out.
So let's exit all the way out of policy map configuration mode and type in
control plane press enter the name of our service policy, which is P map dash
ICMP space.
Then we'll type in service policy space question mark. We want this for traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then we'll type in service policy space question mark. We want this for traffic
coming in to the router space question mark.
So I'll put input, which means coming in and then the name of our policy map,
which is this guy right there and press center.
And we already have a policy map applies. Let's go ahead and remove the old one
. So say no service policy and the name of our previous one, which is P map dash
SSH.
So we'll remove the previous one, which was P map dash SSH and will apply this
to a due to a policy map again.
And then still in control plane configuration mode, we'll type in service WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then still in control plane configuration mode, we'll type in service
policy. We'll specify our new P map for ICMP, which is right there and press
enter.
So now we did a show policy map. It'll show us our policy map. And if we do a
show policy map control plane, it'll show us how it's applied to the control
plane.
So there's our show command right there where we're matching on C map dash ICMP
, which is calling upon access list one zero one.
And if we conform to eight thousand bits per second, we'll go ahead and forward
that traffic or process that traffic.
Anything above that, we're going to go ahead and drop. So if we do a show WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Anything above that, we're going to go ahead and drop. So if we do a show
process to CPU again and just take a look at the output that has the capital
letter CPU in it.
Currently, it's just idling by and we go to our two and we hit the upper key to
attack again. And our three same thing will ping with a timeout of zero.
We'll send it a million times at our one. If we come back here, take a look. We
do show process CPU and press enter. It's gone up a little bit.
But at some point, it's going to start denying traffic and it won't actually
consume all of the CPU. So if we do a show policy map control plane again,
check it out here regarding our C map ICMP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
check it out here regarding our C map ICMP.
As far as conformed, we've conformed with 29 packets and the exceed and
violated. It's been thousands and helps see that even better. Let's go back to
our two.
We'll do a control shift six to break that sequence. And our three will do a
control shift six to break that sequence.
And this time, let's do the pings again. But let's go ahead and do them a
little bit slower. So we won't say a timeout of zero. Let's go ahead and just
simply do no timeout.
The default timeout will start sending those and we'll get our three same thing
, but without the timeout of zero. So now we're just sending normal ICMP traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
, but without the timeout of zero. So now we're just sending normal ICMP traffic
.
But check it out. Not all of it is making it. So here we have one that made it.
One that made it. One that didn't and our two and a good are two same story
there.
And that's because on our one, it's processing some of those ICMP packets,
those ping requests, but not others. And that's because this bad boy right here
, this policy map applied to the control plane called PMAP dash ICMP, where if
traffic is conforming, it's actually being processed.
So now here for the violated packets, that number is still going up. If hit the
up arrow key again, again, that number is still going up. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
up arrow key again, again, that number is still going up.
And that's why the router is not responding to all those ping requests and back
at router one. If we did a show process CPU and press center, check it out.
The impact is not that great on this router. That's because the control plane
policing is stopping all that traffic before the route processor has to respond
.
So now that we've seen a few examples of control plane policing in the next
video, I'd like to put you on a hands on that.
Now, to assist you with that, I'd like to point out one resource on server one
nug that can be very helpful as you work on this lab. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that is this right here. If we minimize multi-tap putty here on the desktop
of server one, there's a document called COPP config.
If you double click on that, that has an example of control plane policing. And
it really should be a C lower case, though, like that.
In any of the case, here's an example of control plane policing. And this
example includes matching on ICMP traffic, IPsec traffic, management traffic,
routing traffic with OSPF, et cetera, and then having multiple class maps and
also having multiple policy maps. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But included this example, there's one specifically for ICMP. So if you want to
leverage this as an example, and you don't have to match on, for example, all
the various types of ICMP, you can just say ICMP any, any.
So here is the access control list that's matching on ICMP. If we get on
further, here is the class map that's looking for that ICMP class and
specifying policing, anything above 8000 bits per second.
And if you scroll down, we finally have this applied to the control plane with
service policy input and then the name of our policy map. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
service policy input and then the name of our policy map.
So if you want to leverage this little text document on the desktop during your
lab as a reference, or if you want to go back to the previous videos, either
way is absolutely great.
So with that in mind, I'll see you in the very next video as I put you on a
hands-on lab.