44-7
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 44 Configuring Control Plane Policing and Layer 2 Control Packet QoS Configuring Control Plane Policing
The following example shows how to configure trusted hosts with source addresses 10.1.1.1 and 10.1.1.2
to forward Telnet packets to the control plane without constraint, while allowing all remaining Telnet
packets to be policed at the specific rate. This example assumes that global QoS is enabled and that the
system-cpp-policy policy map was created.
Switch# config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# qos
Switch(config)# macro global apply system-cpp
! Allow 10.1.1.1 trusted host traffic.
Switch(config)# access-list 140 deny tcp host 10.1.1.1 any eq telnet
! Allow 10.1.1.2 trusted host traffic.
Switch(config)# access-list 140 deny tcp host 10.1.1.2 any eq telnet
! Rate limit all other Telnet traffic.
Switch(config)# access-list 140 permit tcp any any eq telnet
! Define class-map "telnet-class."
Switch(config)# class-map telnet-class
Switch(config-cmap)# match access-group 140
Switch(config-cmap)# exit
! Add the class-map "telnet-class" to "system-cpp-policy" and define the proper action
Switch(config)# policy-map system-cpp-policy
Switch(config-pmap)# class telnet-class
Switch(config-pmap-c)# police 80000 1000 conform transmit exceed drop
Switch(config-pmap-c)# exit
Switch(config-pmap)# exit
! Verify the above configuration steps
Switch# show policy-map system-cpp-policy
Policy Map system-cpp-policy
Class system-cpp-dot1x
Class system-cpp-bpdu-range
Class system-cpp-cdp
police 32000 bps 1000 byte conform-action transmit exceed-action drop
Class system-cpp-sstp
Step 4 Switch(config)# class-map
{traffic-class-name}
Switch(config-cmap)# match access-group
{access-list-number | name
{access-list-name}}
Defines the packet classification criteria. To
identify the traffic associated with the class, use
the match statements.
Step 5 Switch(config-cmap)# exit Returns to global configuration mode.
Step 6 Switch(config)# policy-map
system-cpp-policy
Switch(config-pmap)# class {class-map-name}
Switch(config-pmap-c)# police
[aggregate name] rate burst
[conform-action {drop | transmit}]
[{exceed-action {drop | transmit}}]
Adds the traffic classes to the CoPP policy map.
Uses the police statement to associate actions to
the traffic class.
Step 7 Switch(config)# end Returns to privileged EXEC mode.
Step 8 Switch# show policy-map system-cpp-policy Verifies your entries.
Command Purpose