Reference Guide

For example, BGP and ICMP share same queue (Q6); Q6 has 400 PPS of bandwidth by default.
The desired rate of ICMP is 100 pps and the remaining 300 pps is assigned to BGP. If ICMP
packets comes at 400 pps, BGP packets may be dropped though ICMP packets are rate limited to
100 PPS. This may be solved by increasing Q6 bandwidth to 700 pps to allow both ICMP and
BGP packets and then applying per flow CoPP for ICMP and BGP packets. The setting of this Q6
bandwidth is purely dependent on the incoming traffic for the set of protocols sharing the same
queue. If the user is not aware of the incoming protocol traffic rate then they cannot set the
required Queue Rate Limit value. Such queue bandwidth tuning must be carefully done because
the system cannot open up to handle any rate, including traffic coming at line rate.
CoPP policies are assigned on a per-protocol or a per-queue basis, and are assigned in CONTROL-
PLANE mode to each port-pipe.
The CoPP policies are configured by creating extended ACL rules and specifying rate-limits
through QoS policies. The ACLs and QoS policies are assigned as service-policies.
Configure CoPP for protocols
This section lists the commands necessary to create and enable the service-policies for CoPP.
Refer to Access Control Lists (ACLs) and Quality of Service (QoS) for complete information
about creating ACLs and QoS rules.
The basics for creating a CoPP service policy is to create a Layer 2, Layer 3, and/or an IPv6 ACL
rule for the desired protocol type. Then, create a QoS input policy to rate-limit the protocol traffics
according to the ACL. The ACL and QoS policies are finally assigned to a control-plane service
policy for each port-pipe.
Step Task Command Syntax Command Mode
1 Create a Layer 2 extended ACL for
control-plane traffic policing for a
particular protocol.
mac access-list extended name
cpu-qos permit {arp | frrp | gvrp |
isis | lacp | lldp | stp}
CONFIGURATION
2 Create a Layer 3 extended ACL for
control-plane traffic policing for a
particular protocol.
ip access-list extended name cpu-
qos permit {bgp | dhcp | dhcp-relay
| ftp | icmp | igmp | msdp | ntp | ospf
| pim | ip | ssh | telnet | vrrp}
CONFIGURATION
3 Create an IPv6 ACL for control-
plane traffic policing for a particular
protocol.
ipv6 access-list name cpu-qos
permit {bgp | icmp | vrrp}
CONFIGURATION
4 Create a QoS input policy for the
router and assign the policing.
qos-policy-input name cpu-qos
rate-police
CONFIGURATION
5 Create a QoS class map to
differentiate the control-plane traffic
and assign to an ACL.
class-map match-any name cpu-
qos match {ip | mac | ipv6} access-
group name
CONFIGURATION
6 Create a QoS input policy map to
match to the class-map and qos-
policy for each desired protocol.
policy-map-input name cpu-qos
class-map name qos-policy name
CONFIGURATION