- [Narrator] Control Plane Policing is a feature
used to protect a device's route processor, or RP for short,
from unnecessary traffic.
In certain Denial of Service attacks
if we don't have the protection
offered by Control Plane Policing,
the RP can become overwhelmed with traffic,
which could cause the device
to become completely unresponsive.
Control Plane Policing is essentially a quality
of Service Policy that we use to limit traffic
to a specified rate.
Now, in the context of network security,
there are three Planes of Operation that we must protect.
We must protect the Data Plane, the Control Plane
and the Management Plane.
The Data Plane is also sometimes called the User Plane,
and that carries the network user traffic,
that consists of traffic that is transiting the router,
but which is not destined
to or initiated by the router itself.
So that part of the architecture
decides what to do with packets
that are arriving on an inbound interface.
The Control Plane is identified as any traffic
initiated by the router itself
or destined directly to the router.
So this is used to learn information
required for packet forwarding.
And that includes protocols such as ARP, OSPF and BGP.
The Management Plane is actually a subset
of the Control Plane, and that's used for Device Management,
configuration and monitoring.
The protocols we would find there might be Telnet,
or SSH, just to name a few examples.
And Device Management is a huge part of networking,
so we always need to look at ways to properly secure
that part of our networking architecture from attacks.
Now here, we're going to focus on the Control Plane
in this discussion, because that's relevant
to Control Plane Policing.
When Control Plane Policing is in place,
the Control Plane is considered
to be a completely separate entity on the router,
having its own ingress and egress ports,
ingress being the incoming ports,
egress being the outgoing ports.
This allows not only for filtering of traffic,
but it also allows us to rate limit traffic
using the modular QoS CLI or MQC for short.
And what MQC does is that essentially allows us to create
and attach a traffic policy to an interface.
Now, as you can imagine, when we're talking
about permitting and denying traffic in this manner,
Control Plane Policing is used with an Access Control List.
And the ACL is used to identify the traffic
that should have specific actions taken against it.
And those actions can include things like permit,
deny or rate limit.
Within MQC there are three main concepts.
There are Class Maps, Policy Maps, and Service Policies.
Class Maps enable you to classify network traffic
based on layer three and layer four
traffic flow information.
Things like the source and destination
IP address, the source and destination
port or the IP protocol and also based
on layer seven protocol information,
such as HTTP URLs, HTTP headers, or FTP commands.
Policy Maps define a series of actions or functions
that are going to be applied to a particular Class Map.
And finally, Service Policies are used to specify
where a Policy Map should be implemented.
So you can see how these three concepts work together
within the MQC framework.
So the main goal for Control Plane Policing
is to identify and rate-limit traffic
that is reaching the Control Plane,
so we're essentially trying to prevent
our IOS process memory, our buffers
and our ingress packet queues
from being completely exhausted.
So this is a really great protection against Denial
of Service attacks on our routers and switches.
In our very next video, we're going to take a look
at how we can configure Control Plane Policing in IOS.