16.3 Control Plane Policing (CoPP) & Control Plane Protection (CPPr)
Key Takeaways
- The Route Processor (RP) CPU represents the single point of failure in network devices; unpoliced control plane traffic storms, routing protocol attacks, and packet punting cause CPU starvation, protocol flapping (OSPF/BGP), and network-wide outages.
- Control Plane Policing (CoPP) utilizes the Modular QoS CLI (MQC) framework (Class-maps, Policy-maps, Service-policies) applied globally to the virtual `control-plane` interface to classify, rate-limit (police), or drop traffic before reaching the RP CPU.
- Control Plane Protection (CPPr) enhances CoPP by segmenting control plane traffic into three dedicated physical/logical subinterfaces: Host (traffic addressed to router interface IPs), Transit (software-switched packets with IP options), and CEF-Exception (traffic generating ICMP error punts or ARP misses).
- Hardware-enforced silent drops at the ASIC/TCAM layer discard unauthorized or malicious packets instantly without taxing the RP CPU, whereas software drops force the CPU to generate ICMP Unreachable or TTL Expired packets, exacerbating DoS conditions.
- A defensible CoPP policy establishes multi-tier CIR policing: routing protocols (OSPF, BGP, BFD) are granted dedicated high-bandwidth committed rates, management traffic (SSH, SNMP, NTP) is restricted to authorized subnets, and hostile/scanned traffic (Telnet, IP fragments) is dropped immediately.
16.2 Control Plane Policing (CoPP) & Control Plane Protection (CPPr)
Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 5.2.b (CoPP), one of the two infrastructure security features named alongside ACLs, requires candidates to configure and verify Control Plane Policing (CoPP) and understand Control Plane Protection (CPPr). Candidates must master the Route Processor (RP) architecture, the Modular QoS CLI (MQC) framework applied to control-plane interfaces, packet classification using extended ACLs, CIR rate-limiting and drop actions, and the distinct subinterface architecture of CPPr (Host, Transit, and CEF-Exception subinterfaces).
In modern enterprise routing and switching architectures, packet forwarding is split between two primary domains: the Data Plane (Forwarding Engine), implemented in high-speed hardware Application-Specific Integrated Circuits (ASICs) and Ternary Content-Addressable Memory (TCAM), and the Control Plane (Route Processor / RP CPU), which handles routing protocol state machines (OSPF, EIGRP, BGP, IS-IS), Bidirectional Forwarding Detection (BFD), Spanning Tree Protocol (STP), device management sessions (SSH, SNMP), and packet exceptions.
While hardware ASICs can forward tens of millions of packets per second (Mpps) at line rate, the Route Processor CPU has finite processing capacity. If a flood of unauthorized, malformed, or high-volume traffic is punted to the RP CPU, CPU utilization spikes to 100%. This CPU starvation causes routing protocol keepalives to drop, BGP neighbors to reset, BFD timers to expire, and Spanning Tree topology change storms—collapsing the entire network even if physical links have ample available bandwidth.
+---------------------------------------------------------------------------------------------------+
| CONTROL PLANE POLICING (CoPP) INGESTION PIPELINE |
+---------------------------------------------------------------------------------------------------+
| |
| [ INGRESS DATA TRAFFIC ] -----> [ HARDWARE CEF ASIC / TCAM ] ======> [ LINE-RATE EGRESS DATA ] |
| | |
| (Punt Condition) |
| v |
| =========================================== |
| | CONTROL PLANE POLICING (CoPP) FILTER | |
| | (Hardware MQC Rate Limiter & Policer) | |
| =========================================== |
| / | \ |
| / | \ |
| [ CRITICAL ROUTING ] [ AUTHORIZED MGMT ] [ HOSTILE / SCANS ] |
| - BGP / OSPF / EIGRP - SSH / SNMP / NTP - Telnet / Malformed |
| - BFD / LDP / RSVP - Strict Subnet ACLs - RFC 1918 Spoofs |
| | | | |
| (Police: 5 Mbps) (Police: 1 Mbps) (Action: DROP) |
| | | | |
| v v x (Silent Hardware Drop) |
| +-------------------------------------------------------------+ |
| | ROUTE PROCESSOR (RP CPU) | |
| | - OSPF Shortest Path First - BGP Best Path Computation | |
| | - SSH Cryptographic Tunnel - SNMP MIB Processing Engine | |
| +-------------------------------------------------------------+ |
+---------------------------------------------------------------------------------------------------+
1. Control Plane Vulnerabilities & Silent vs. Software Drops
When traffic enters a router interface, Cisco Express Forwarding (CEF) evaluates the destination IP against the hardware Forwarding Information Base (FIB) and Adjacency Table. Packets fall into three forwarding categories:
- Hardware-Switched Transit Traffic: Packets whose destination matches a valid FIB entry with a resolved Layer 2 adjacency. Forwarded entirely in hardware ASICs without CPU involvement.
- Direct Control/Management Plane Traffic: Packets explicitly addressed to the router's local IP addresses (e.g., SSH management sessions, BGP peering packets, OSPF multicast hello packets
224.0.0.5, SNMP queries, ICMP pings to the router). - CEF Exception (Punted) Traffic: Data packets transiting the router that cannot be resolved in hardware and must be punted to the Route Processor CPU for software processing:
- Packets containing IP Options (e.g., Record Route, Strict Source Route).
- Packets exceeding interface MTU with the Don't Fragment (DF) bit set (requiring generation of ICMP Type 3 Code 4).
- Packets with Time to Live $\text{TTL} \le 1$ (requiring generation of ICMP Type 11 Code 0 Time Exceeded).
- ARP cache misses (packets destined to an unresolved subnet host triggering the RP to generate ARP requests).
- Packets requiring unsupported Layer 2/Layer 3 encapsulation or fragmentation.
+---------------------------------------------------------------------------------------------------+
| HARDWARE SILENT DROPS VS. SOFTWARE CPU DROPS |
+---------------------------------------------------------------------------------------------------+
| Drop Mechanism | Architectural Execution | Impact on Route Processor CPU |
| :---------------------- | :-------------------------- | :---------------------------------------- |
| **Hardware Silent Drop**| Executed directly in ASIC | **Zero CPU Overhead.** The packet is |
| **(CoPP / TCAM Drop)** | rate-limiter / TCAM table | discarded in hardware before it ever reaches|
| | before reaching the CPU bus | the CPU internal input queue. |
| **Software CPU Drop** | Forwarded across CPU bus; | **High CPU Overhead.** The RP CPU must |
| **(ACL / Unreachable)** | RP inspects packet, drops it,| allocate memory buffers, parse headers, |
| | and generates ICMP response | and generate ICMP error datagrams. |
+---------------------------------------------------------------------------------------------------+
[!IMPORTANT] An effective CoPP policy relies on Hardware Silent Drops. If a router is subjected to an ICMP flood or unauthorized port scan, simply applying an ingress ACL that causes the router to generate
ICMP Destination Unreachablemessages will overwhelm the RP CPU. CoPP drops the traffic silently in hardware ASICs, neutralizing DoS attacks.
2. The Modular QoS CLI (MQC) Framework for CoPP
Control Plane Policing is implemented using the standardized three-step Modular QoS CLI (MQC) architecture:
+---------------------------------------------------------------------------------------------------+
| THE 3-STEP MQC CONFIGURATION PIPELINE |
+---------------------------------------------------------------------------------------------------+
| |
| STEP 1: CLASS-MAP (Traffic Classification) |
| - Identifies and groups traffic matching specific criteria using Extended ACLs: |
| * 'class-map match-any COPP-ROUTING-CLASS' |
| * 'class-map match-any COPP-MANAGEMENT-CLASS' |
| * 'class-map match-any COPP-UNDESIRABLE-CLASS' |
| |
| STEP 2: POLICY-MAP (Action Enforcement & Rate Limiting) |
| - Defines QoS actions per traffic class using Committed Information Rate (CIR) policing: |
| * Critical Class: 'police cir 5000000 conform-action transmit exceed-action transmit' |
| * Normal Class: 'police cir 1000000 conform-action transmit exceed-action drop' |
| * Hostile Class: 'drop' |
| |
| STEP 3: SERVICE-POLICY (Global Control Plane Attachment) |
| - Attaches the policy-map directly to the global virtual control-plane: |
| * 'control-plane' |
| * 'service-policy input COPP-GLOBAL-POLICY' |
+---------------------------------------------------------------------------------------------------+
Multi-Tier Traffic Classification Architecture
A robust enterprise CoPP policy structures traffic into prioritized functional classes:
| Traffic Class | Protocol Composition & Matching ACLs | Target Action & Rate Limiting Strategy |
|---|---|---|
| Critical Routing | OSPF (IP Proto 89), EIGRP (IP Proto 88), BGP (TCP 179), BFD (UDP 3784/3785), LDP (TCP/UDP 646), VRRP/HSRP | High CIR rate (e.g., 5–10 Mbps). Exceed action set to transmit or high burst allowance to guarantee zero control protocol drops. |
| Authorized Mgmt | SSH (TCP 22), SNMP (UDP 161), NTP (UDP 123), TACACS+ (TCP 49), RADIUS (UDP 1812/1813) from authorized subnets | Medium CIR rate (e.g., 1–2 Mbps). Conforming traffic transmitted; exceeding traffic dropped. Restricted strictly to trusted admin prefixes. |
| Diagnostic / Normal | ICMP Echo Requests, Traceroute probes, ARP requests, IGMP/MLD group memberships | Moderate CIR rate (e.g., 250–500 kbps). Aggressive exceed drop to eliminate ping floods. |
| Undesirable / Attack | Telnet (TCP 23), HTTP (TCP 80), IP fragments, IP Options, RFC 1918 spoofing from public interfaces | Drop immediately (drop action) without rate limiting. |
| Class-Default | All unclassified residual control plane traffic | Low catch-all rate (e.g., 100 kbps) with drop exceed action to absorb unexpected traffic bursts. |
3. Control Plane Protection (CPPr) Subinterfaces
While CoPP applies a single global policy to the entire control plane, Control Plane Protection (CPPr) provides granular protection by dividing the control plane into three distinct virtual subinterfaces:
+---------------------------------------------------------------------------------------------------+
| CONTROL PLANE PROTECTION (CPPr) SUBINTERFACES |
+---------------------------------------------------------------------------------------------------+
| |
| 1. HOST SUBINTERFACE ('control-plane host') |
| - Intercepts all traffic destined directly to the router's local physical or logical IPs. |
| - Protocols: SSH, Telnet, SNMP, NTP, BGP peering, RADIUS/TACACS+ replies, local ICMP pings. |
| - Feature Support: Full MQC policing, Port-Filtering, and Closed User Groups (CUG). |
| |
| 2. TRANSIT SUBINTERFACE ('control-plane transit') |
| - Intercepts non-exception data traffic that transits through the router but requires software|
| handling by the Route Processor CPU. |
| - Packets: Packets with IP Options (Record Route, Timestamp), unsupported tunnel types, |
| and Layer 2 metadata punts. |
| |
| 3. CEF-EXCEPTION SUBINTERFACE ('control-plane cef-exception') |
| - Intercepts data packets that trigger hardware CEF exceptions and force the RP CPU to |
| generate error responses or perform Layer 2 address resolution. |
| - Packets: Packets with TTL <= 1 (generating ICMP Time Exceeded), packets exceeding MTU |
| with DF=1 (generating ICMP Fragmentation Needed), and ARP resolution misses. |
+---------------------------------------------------------------------------------------------------+
+---------------------------------------------------------------------------------------------------+
| CoPP VS. CPPr ARCHITECTURAL COMPARISON |
+---------------------------------------------------------------------------------------------------+
| Architectural Feature | Control Plane Policing (CoPP) | Control Plane Protection (CPPr)|
| :-------------------------- | :---------------------------------- | :---------------------------- |
| **Attachment Point** | Global virtual `control-plane` | Three dedicated subinterfaces: |
| | interface | `host`, `transit`, `cef-exception`|
| **Granularity** | Coarse / Aggregate control plane | Granular per-subinterface |
| | bucket | isolation |
| **Port-Filtering Feature** | Not supported | **Supported** on Host subif |
| | | (Drops closed ports instantly) |
| **CEF Exception Isolation** | Mixed with general control traffic | **Dedicated CEF-Exception subif|
| | | (Prevents ICMP storm punts) |
| **Queue Architecture** | Single aggregate hardware queue | Dedicated hardware queues per |
| | | subinterface category |
+---------------------------------------------------------------------------------------------------+
CPPr Port-Filtering and Closed User Groups (CUG)
On the Host subinterface, CPPr introduces Port-Filtering:
- Network devices listen on various standard UDP/TCP ports. Attackers scan devices by probing unused ports, forcing the RP CPU to process the transport header and generate
ICMP Port Unreachableresponses. - CPPr Port-Filtering allows administrators to define a whitelist of permitted open ports (e.g., TCP 22 for SSH, BGP 179). Any packet arriving for a non-whitelisted port is dropped silently in hardware before reaching the host input queue.
4. Cisco IOS-XE CoPP & CPPr Configuration & Verification
Step-by-Step CoPP Configuration Example
! Step 1: Define Extended Access Control Lists for Traffic Categories
ip access-list extended ACL-COPP-CRITICAL-ROUTING
permit ospf any any
permit eigrp any any
permit tcp any eq bgp any
permit tcp any any eq bgp
permit udp any eq 3784 any
permit udp any any eq 3784
!
ip access-list extended ACL-COPP-MGMT-AUTHORIZED
permit tcp 10.1.100.0 0.0.0.255 any eq 22
permit udp 10.1.100.0 0.0.0.255 any eq snmp
permit udp 10.1.100.0 0.0.0.255 any eq ntp
!
ip access-list extended ACL-COPP-DIAGNOSTIC-ICMP
permit icmp any any echo
permit icmp any any echo-reply
permit icmp any any time-exceeded
permit icmp any any unreachable
!
ip access-list extended ACL-COPP-UNDESIRABLE
permit tcp any any eq telnet
permit tcp any any eq www
permit ip host 0.0.0.0 any
permit ip 10.0.0.0 0.255.255.255 any
!
! Step 2: Define MQC Class-Maps
class-map match-any CLASS-COPP-ROUTING
match access-group name ACL-COPP-CRITICAL-ROUTING
class-map match-any CLASS-COPP-MGMT
match access-group name ACL-COPP-MGMT-AUTHORIZED
class-map match-any CLASS-COPP-DIAG
match access-group name ACL-COPP-DIAGNOSTIC-ICMP
class-map match-any CLASS-COPP-BAD
match access-group name ACL-COPP-UNDESIRABLE
!
! Step 3: Define MQC Policy-Map with Multi-Tier Committed Information Rates (CIR)
policy-map POLICY-COPP-ENTERPRISE
class CLASS-COPP-ROUTING
police cir 10000000 bc 312500
conform-action transmit
exceed-action transmit
class CLASS-COPP-MGMT
police cir 2000000 bc 62500
conform-action transmit
exceed-action drop
class CLASS-COPP-DIAG
police cir 500000 bc 15625
conform-action transmit
exceed-action drop
class CLASS-COPP-BAD
drop
class class-default
police cir 100000 bc 3125
conform-action transmit
exceed-action drop
!
! Step 4: Attach Policy-Map to Global Control-Plane Interface (CoPP)
control-plane
service-policy input POLICY-COPP-ENTERPRISE
CPPr Subinterface Attachment Example
! Attaching granular policies to CPPr Subinterfaces
control-plane host
service-policy input POLICY-CPPR-HOST
!
control-plane transit
service-policy input POLICY-CPPR-TRANSIT
!
control-plane cef-exception
service-policy input POLICY-CPPR-CEF-EXCEPTION
CoPP Operational Verification & Counter Inspection
Router# show policy-map control-plane
Control Plane
Service-policy input: POLICY-COPP-ENTERPRISE
Class-map: CLASS-COPP-ROUTING (match-any)
1248900 packets, 114898800 bytes
5 minute offered rate 12000 bps, drop rate 0000 bps
Match: access-group name ACL-COPP-CRITICAL-ROUTING
police:
cir 10000000 bps, bc 312500 bytes
conformed 1248900 pkts, 114898800 bytes; actions:
transmit
exceeded 0 pkts, 0 bytes; actions:
transmit
conformed 12000 bps, exceeded 0000 bps
Class-map: CLASS-COPP-DIAG (match-any)
985420 packets, 82775280 bytes
5 minute offered rate 145000 bps, drop rate 82000 bps
Match: access-group name ACL-COPP-DIAGNOSTIC-ICMP
police:
cir 500000 bps, bc 15625 bytes
conformed 412000 pkts, 34608000 bytes; actions:
transmit
exceeded 573420 pkts, 48167280 bytes; actions:
drop
conformed 500000 bps, exceeded 82000 bps
Class-map: CLASS-COPP-BAD (match-any)
142055 packets, 11932620 bytes
5 minute offered rate 42000 bps, drop rate 42000 bps
Match: access-group name ACL-COPP-UNDESIRABLE
drop
During a distributed denial-of-service (DDoS) attack targeting a core enterprise router, an attacker floods the device with 200,000 ICMP Echo Request packets per second. As a result, the Route Processor CPU utilization reaches 100%, causing OSPF adjacency dead timers to expire and flapping core routing paths. How does implementing Control Plane Policing (CoPP) resolve this vulnerability?
A network security engineer is implementing Control Plane Protection (CPPr) on a Cisco router to mitigate attacks that exploit hardware exception conditions. The engineer needs to apply rate-limiting specifically to packets that force the Route Processor CPU to generate ICMP Time Exceeded (TTL expired in transit) and ICMP Destination Unreachable messages. To which CPPr subinterface must this service policy be attached?
An administrator observes that when an attacker sends unauthorized Telnet connection attempts to a router's management interface, applying an inbound interface ACL generates substantial CPU overhead because the router generates 'ICMP Destination Unreachable: Administratively Prohibited' (Type 3 Code 13) error packets for every blocked connection. Which CoPP action eliminates this CPU overhead entirely?
A network engineer investigates high CPU utilization on a border router and discovers that an external scanning tool is sending transit IP packets containing IP Options (such as Record Route and Strict Source Route) through the autonomous system. Because hardware CEF cannot process IP Options in hardware, every packet is punted to the Route Processor. Under Control Plane Protection (CPPr), which subinterface is specifically designed to police this software-switched transit traffic?