Syntax: switch# config switch(config)# copp-policy test_1 switch(config-copp)# class ? drop Drop packets matching this class factory-default Set this class to factory default configuration priority Specify the priority for this class switch(config-copp)# class drop ? switch(config-copp)# class factory-default ? switch(config-copp)# class priority ? <0-6> The priority for this class switch(config-copp)# class priority <0-6> ? rate Specify the rate for this class switch(config-copp)# class priority rate ? <25-99999> The rate for this class in units of packets per second switch(config-copp)# class priority rate ? burst Specify the burst for this class switch(config-copp)# class priority rate burst ? <1-9999> The burst for this class in units of packets switch(config-copp)# class priority <0-6> rate <25-99999> burst <1-9999> ? switch(config-copp)# exit switch(config)# Example: 6300# config 6300(config-copp)# copp-policy test_1 6300(config-copp)# class acl-logging priority 1 rate 50 burst 100 6300(config-copp)# default-class priority 2 rate 4225 burst 528 6300(config-copp)# exit 6300(config)# exit 6300# Impact: CoPP is crucial for protecting the control plane and preventing network outages. It does, however, require careful configuration and monitoring to avoid unintended side effects. Misconfiguration can lead to performance degradation, network disruptions, and management issues, such as: - Excessive Policing: Overly restrictive CoPP policies can drop legitimate control plane traffic, leading to delayed or lost routing updates, impaired management access, and potentially impacting network performance. - CPU Cycle Consumption: If not configured effectively it can consume CPU cycles. - Slow or Unresponsive CLI Sessions: High CPU utilization or resource exhaustion caused by excessive traffic to the control plane can make interactive sessions via the command-line interface (CLI) slow or unresponsive. - Route Flaps: Excessive policing of line protocol keepalives or routing protocol updates (like BGP or OSPF updates) can lead to unstable routing, route flaps, neighbor adjacency flaps or timeouts, causing network instability. - Resource Exhaustion: A poorly configured CoPP policy could lead to route processor resource exhaustion, resulting in resources like memory and buffers becoming unavailable for legitimate IP data packets. - Unintended Errors: Incorrectly configured CoPP policies can lead to unintended consequences, such as blocking legitimate traffic or failing to adequately protect the control plane.

Name	Audit Name	Plugin	Category
4.1.1 Control Plane Policing	CIS HPE Aruba Networking CX Switch v1.0.1 L2	ArubaOS	SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION
4.1.1 Control Plane Policing	CIS HPE Aruba Networking CX Switch v1.0.1 Optional Security Recommendations	ArubaOS	SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

Detections

Analytics

Item Search