- [Instructor] When configuring control plane policing,
we'll go through four main steps.
First, we'll want to create an ACL
to identify our traffic
and then we'll want to create a class map
to classify the traffic that matches the ACL.
Then we'll want to create a policy map
to define the action that we want taken
for the traffic named in the class map.
And finally,
we'll use a service policy statement
to apply everything to the control plane interface.
Let's connect to a live interface
and see how we can do that.
Here we're connected into a very simple topology,
I had a single PC connected to a single router
and that's it.
And the way I'm going to demonstrate control plane policing,
First thing I'm going to do is I'm going to start
a continuous ping from this host PC
over to my router at 192.168.0.1
I can use the keyword repeat followed
by a really large number
and that will essentially give me a continuous ping.
So I'll get that going
and you can see that at the moment,
that's completely successful,
we have no control plane policing policy in place
that will be limiting ICMP traffic in any way.
Let's jump over now to our router,
so we're connected into that
and the first thing we want to do,
let's create an extended access list.
So under global configuration mode,
we can say IP access-list extended,
and we can give that a number or a name.
I'll just use 100,
the first number in the range.
I'll hit enter
and now you can see that we're under
access list configuration mode.
So I can add a permit statement.
So I'll say permit ICMP, any, any.
And what this is going to do,
now, it might seem counterintuitive to use
the permit statement rather than a deny statement.
But what this is actually doing remember,
we're using this ACL only to identify
the traffic for policing rather
than for filtering purposes.
We'll actually block the traffic
or rate limit it
or do something else with it
at a later point in the configuration.
So right now we're only using the ACL
to identify the traffic
and we do that with a permit statement.
So we have that created,
we have our access control list.
Next, we want to create a class-map.
That's the second step.
So back under global configuration mode,
we can use the command class-map.
And if we look at contextual help,
the top option you see that we can give that a name.
So I'm going to call that PING in all caps
just very simple,
very intuitive name.
Once I hit enter,
we're now under class-map configuration mode.
And if we look at our contextual help, yet again,
the option under there we want to use is match.
From there once we have matched the match keyword
if we look at our contextual help again,
the very first option there is access-group.
That's exactly what we want to use,
I'm going to break out of that output
and I can say access-group
and then we can callout either the name
or the number of the access control list.
Remember, we already created our access control lists,
so we can simply point this to that
by adding the number 100,
which is the access control list we created.
I'll hit enter,
and that's completed.
I going to exit again,
going back to global configuration mode
and now we can create the policy map
and give that a name.
So I'll use the command policy-map followed by the name.
I'll just call that PING-POLICY
I'll hit enter
and now we're under policy-map configuration mode.
We're going to reference the previously created class-map here.
Now if we look at contextual help under these options,
notice they're just a bit different.
There's no match statement this time.
Instead, we have the class option,
which is exactly what we want to use,
followed by the name of the class-map
that we just created,
which was PING.
Now we can hit enter,
and we are under policy-map configuration mode.
Now we can define the actions
that we want taken against the identified traffic.
If we look at our contextual help,
you can see those options are quite numerous.
Lots of things you can do,
you can permit,
you can drop,
I'm going to choose the keyword that we see here,
which is police.
So I'll say police
and if I look at contextual help again,
you can see that we can do that in a couple of ways.
I'm going to use that very first option
that we see there,
the target bit rate
and that's going to allow us
to set a target bit rate in bits per second.
Notice that on the low end,
the lowest value we can use is 8,000 bits per second,
which is pretty low,
it probably wouldn't want to do that in production
but in this example,
I'm going to say 8,000 bits per second
and if we look at contextual help again,
the option that I'm choosing is conform-action.
And this is going to allow us to choose the action
that's taken if our traffic conforms to this rate
or in other words,
if the rate is less than 8,000 bits per second,
what's going to happen?
So we have conform-action,
what do we want it to do if it conforms?
So a couple of options that I want to point out
the very top option,
again lots of options here,
but the top option,
a couple of simple ones are drop,
the bottom option being transmit.
So in my case,
I'm going to say that I'm going to choose the option
for transmit.
So if the traffic is conformed
to the bit rate that I've specified,
if the traffic is at or lower than 8,000 bits per second,
it's going to allow the traffic to pass.
Contextual help again indicates we can complete
that with the exceed-action keyword.
In other words,
if the rate is higher than we want
coming into the control plane,
so if it's higher than 8,000 bits per second in this case,
what's going to happen?
So we can say exceed-action,
we'll look at our help commands again
and we again have that same set of commands,
the top being dropped,
the bottom being transmit.
So this time,
I'm going to say drop.
So the entire command what's happening here,
we're policing the traffic, ICMP traffic.
If the traffic is coming in
at a rate less than 8,000 bits per second,
it's going to transmit,
if it exceeds that it's going to drop it.
So that's very simply what we have here.
Now I'll hit enter with that,
that's going to complete this part of our configuration.
The final step is the service policy
which is going to apply everything
to the control plane interface.
So let me go back under global configuration mode,
just as we would with all the other configuration,
we want to be under global configuration mode.
And if we were going to apply this to a normal interface,
we would go under the interface itself,
we would say maybe gig zero/one
if we wanted to apply that to a physical interface.
In this case,
we're applying that to our control plane interface.
So we can use the keyword control-plane.
And notice now we're under control blank configuration mode.
So this acts as a type of interface for us
when we're under that mode.
Now, if we look at our options here,
you can probably guess from the output,
the option under control plane configuration
that we want is service-policy
that's going to allow us to callout our policy
that we've created.
If we look at contextual help,
we can choose the input option
to apply the policy to the input
of the control plane interface.
And of course,
the final option is to actually reference
the policy map name that we created,
which is PING-POLICY in my case,
I'll hit enter.
Once we do that,
once we hit enter,
if we jump back over to the host PC,
you'll notice some gaps in there.
So we're now experiencing drops in ICMP replies
and that's because of the policing rate limits
that we've set up.
We can go back to router one,
and we can break out of that.
We can run the verification command
show policy-map,
control-plane,
and this is going to allow us to see information
about the policy map that is applied to our control plane.
Notice that we can see the number of packets
that are conformed to our policing,
and the number of packets
that have exceeded our policing.
So we can see both of those in there
and if we actually run that command again,
you'll see those numbers are going to go up.
So the original number up here is 359 up to 469,
the original number of 26 exceeded up to 34.
So it looks like that is working exactly
as we would expected to see
and that continues to grow.
Those numbers are growing
because of the continuous ping
that's coming from the PC into the host.
So this policing policy is rate limiting
the ICMP traffic that is arriving on our router.
So that's a look at how we can
use control plane policing
to limit traffic rates coming
into the control plane on our router.