Configuration Example
- Tracy Yang
Owned by Tracy Yang
Nov 13, 2023
16 min read
Loading data...
Networking Requirements
In order to protect switch CPU from attacks and being overloaded by control plane packets, maintaining data forwarding and network topology stability, configure different CoPP policy for flows of different control plane protocols: SSH, NTP, TFTP and SLOW.
Procedure
Step1Â Â Â Â Â Â Â Â Configure CoPP queue mapping, scheduling weight, scheduling algorithm and queue shaping.
admin@Xorplus# set class-of-service scheduler copp-scheduler180 mode WRR admin@Xorplus# set class-of-service scheduler copp-scheduler180 max-bandwidth-pps 180 admin@Xorplus# set class-of-service scheduler copp-scheduler180 min-bandwidth-pps 0 admin@Xorplus# set class-of-service scheduler copp-scheduler180 weight 5 admin@Xorplus# set class-of-service scheduler-profile copp-profile forwarding-class copp-class1 scheduler copp-scheduler180 admin@Xorplus# set class-of-service scheduler-profile copp-profile forwarding-class copp-class2 scheduler copp-scheduler180 Â admin@Xorplus# set class-of-service scheduler copp-scheduler200 mode WRR admin@Xorplus# set class-of-service scheduler copp-scheduler200 max-bandwidth-pps 200 admin@Xorplus# set class-of-service scheduler copp-scheduler200 min-bandwidth-pps 0 admin@Xorplus# set class-of-service scheduler copp-scheduler200 weight 10 admin@Xorplus# set class-of-service scheduler-profile copp-profile forwarding-class copp-class3 scheduler copp-scheduler200 Â admin@Xorplus# set class-of-service scheduler copp-scheduler300 mode WRR admin@Xorplus# set class-of-service scheduler copp-scheduler300 max-bandwidth-pps 300 admin@Xorplus# set class-of-service scheduler copp-scheduler300 min-bandwidth-pps 0 admin@Xorplus# set class-of-service scheduler copp-scheduler300 weight 20 admin@Xorplus# set class-of-service scheduler-profile copp-profile forwarding-class copp-class4 scheduler copp-scheduler300
        #Configure a policer 50pps.
admin@Xorplus# set firewall policer 50pps if-exceeding rate-limit 50 admin@Xorplus# set firewall policer 50pps if-exceeding burst-limit 50
       #Configure mapping between forwarding class and local priority.
admin@Xorplus# set class-of-service forwarding-class copp-class1 local-priority 1 admin@Xorplus# set class-of-service forwarding-class copp-class2 local-priority 2 admin@Xorplus# set class-of-service forwarding-class copp-class3 local-priority 3 admin@Xorplus# set class-of-service forwarding-class copp-class4 local-priority 4
Step2        Configure destination-port and protocol to classify SSH flow, and mapping to forwarding class copp-class3.
admin@Xorplus# set firewall filter copp sequence 83 from destination-port 22 admin@Xorplus# set firewall filter copp sequence 83 from protocol tcp admin@Xorplus# set firewall filter copp sequence 83 then forwarding-class copp-class3 admin@Xorplus# set firewall filter copp sequence 83 then policer 50pps  admin@Xorplus# set firewall filter copp sequence 84 from source-port 22 admin@Xorplus# set firewall filter copp sequence 84 from protocol tcp admin@Xorplus# set firewall filter copp sequence 84 then forwarding-class copp-class3 admin@Xorplus# set firewall filter copp sequence 84 then policer 50pps Â
Step3Â Â Â Â Â Â Â Â Configure destination-port, protocol and ether-type to classify NTP (Network Time Protocol) flow, and mapping to forwarding class copp-class1.
admin@Xorplus# set firewall filter copp sequence 91 from destination-port 123 admin@Xorplus# set firewall filter copp sequence 91 from protocol udp admin@Xorplus# set firewall filter copp sequence 91 then forwarding-class copp-class1 Â admin@Xorplus# set firewall filter copp sequence 92 from destination-port 123 admin@Xorplus# set firewall filter copp sequence 92 from ether-type 34525 admin@Xorplus# set firewall filter copp sequence 92 from protocol udp admin@Xorplus# set firewall filter copp sequence 92 then forwarding-class copp-class1
 Step4        Configure destination-port, protocol and ether-type to classify TFTP flow, and mapping to forwarding class copp-class2.
admin@Xorplus# set firewall filter copp sequence 108 from destination-port 69 admin@Xorplus# set firewall filter copp sequence 108 from protocol udp admin@Xorplus# set firewall filter copp sequence 108 then forwarding-class copp-class2 Â admin@Xorplus# set firewall filter copp sequence 109 from source-port 69 admin@Xorplus# set firewall filter copp sequence 109 from protocol udp admin@Xorplus# set firewall filter copp sequence 109 then forwarding-class copp-class2
 Step5        Configure destination-mac-address and ether-type to classify SLOW flow, and mapping to forwarding class copp-class4.
admin@Xorplus# set firewall filter copp sequence 111 from destination-mac-address 01:80:C2:00:00:02 admin@Xorplus# set firewall filter copp sequence 111 from ether-type 34825 admin@Xorplus# set firewall filter copp sequence 111 then forwarding-class copp-class4
Step6      Commit the configuration.
admin@XorPlus# commit
Verify the Configuration
- Â You can use the run show copp bandwidth command to view the bandwidth information, scheduling information and local priority of the forwarding class.
admin@Xorplus# run show copp bandwidth Forwarding Class Min-Bandwidth Max-Bandwidth Weight Local-Priority Schedule-Mode default-class       0            100         24    0             WRR         copp-class1         0            180         5     1             WRR         copp-class2         0            180         5     2             WRR         copp-class3         0           200         10    3             WRR         copp-class4         0            300         20    4             WRR     pim-class 0 80 16 8 WRR igmp-class 0 80 16 9 WRR vrrp-class 0 80 16 10 WRR dhcp-class 0 80 16 11 WRR rip-class 0 80 16 12 WRR ospf-class 0 80 16 13 WRR bgp-class 0 80 16 14 WRR mlag-mac-sync-class 0 80 16 15 WRR mlag-class 0 80 16 16 WRR bfd-class 0 80 16 17 WRR arp-class 20 80 32 18 WRR arp-class 20 80 32 19 WRR lldp-class 20 80 32 20 WRR lacp-class 20 80 32 21 WRR bpdu-class 20 80 32 22 WRR management-class 20 80 12 23 WRR mvrp-class 100 500 32 24 WRR erps-class 100 500 32 25 WRR ripng-class 0 500 16 26 WRR Â
- You can use the run show filter copp command to view the configuration information of all CoPP policies, both pre-defined and user-defined, and match counter.
admin@Xorplus# run show filter copp       Filter: copp          Description:          Sequence: 10              Description:              match counter: 0 packets              match-condition:                 protocol:                bpdu              action: forward              forwarding_class: bpdu-class              ......          Sequence: 81              Description:              match counter: 0 packets              match-condition:                 destination-port:        23..23                 protocol:                tcp              action: forward              forwarding_class: copp-class3          Sequence: 82              Description:              match counter: 0 packets              match-condition:                 destination-port:        107..107                 protocol:                tcp              action: forward              forwarding_class: copp-class3              policer: 50pps          Sequence: 83              Description:              match counter: 0 packets              match-condition:                 destination-port:        22..22                 protocol:                tcp              action: forward              forwarding_class: copp-class3              policer: 50pps          Sequence: 84              Description:              match counter: 0 packets              match-condition:                 protocol:                tcp                 source-port:             22..22              action: forward              forwarding_class: copp-class3              policer: 50pps          Sequence: 90              Description:              match counter: 0 packets              match-condition:                 protocol:                dhcp              action: forward              forwarding_class: dhcp-class          Sequence: 91              Description:              match counter: 0 packets              match-condition:                 destination-port:        123..123                 protocol:                udp              action: forward              forwarding_class: copp-class1          Sequence: 92              Description:              match counter: 0 packets              match-condition:                 destination-port:        123..123                 ether-type:              0x86dd                 protocol:                udp              action: forward              forwarding_class: copp-class1          Sequence: 100              Description:              match counter: 0 packets              match-condition:                 protocol:                vrrp              action: forward              forwarding_class: vrrp-class          Sequence: 108              Description:              match counter: 0 packets              match-condition:                 destination-port:        69..69                 protocol:                udp              action: forward              forwarding_class: copp-class2          Sequence: 109              Description:              match counter: 0 packets              match-condition:                 protocol:                udp                 source-port:             69..69              action: forward              forwarding_class: copp-class2          Sequence: 110              Description:              match counter: 0 packets              match-condition:                 protocol:                igmp              action: forward              forwarding_class: igmp-class          Sequence: 111              Description:              match counter: 0 packets              match-condition:                 destination-mac-address: 01:80:c2:00:00:02                 ether-type:              0x8809              action: forward              forwarding_class: copp-class4          ......        Input interface: inbound-control-plane
- You can use the run show class-of-service interface inbound-control-plane command to view the detail configuration information of CoPP profile.
admin@Xorplus# run show class-of-service interface inbound-control-plane Interface : inbound-control-plane Scheduler-profile : copp-profile Forwarding-class Local-priority Scheduler Min-Bandwidth Max-Bandwidth Weight Schedule-Mode ------------------ -------------- --------------------- ------------- ------------- ------ ------------- default-class 0 default-scheduler 0 80 8 WRR pim-class 8 pim-scheduler 0 80 16 WRR igmp-class 9 igmp-scheduler 0 80 16 WRR vrrp-class 10 vrrp-scheduler 0 80 16 WRR dhcp-class 11 dhcp-scheduler 0 80 16 WRR rip-class 12 rip-scheduler 0 80 16 WRR ospf-class 13 ospf-scheduler 0 80 16 WRR bgp-class 14 bgp-scheduler 0 80 16 WRR mlag-mac-sync-class 15 mlag-mac-sync-scheduler 0 80 16 WRR mlag-class 16 mlag-scheduler 0 80 16 WRR bfd-class 17 bfd-scheduler 0 80 16 WRR ndp-class 18 arp-scheduler 20 80 32 WRR arp-class 19 arp-scheduler 20 80 32 WRR lldp-class 20 lldp-scheduler 20 80 32 WRR lacp-class 21 lacp-scheduler 20 80 32 WRR bpdu-class 22 bpdu-scheduler 20 80 32 WRR management-class 23 management-scheduler 20 80 12 WRR mvrp-class 24 mvrp-scheduler 20 80 32 WRR erps-class 25 erps-scheduler 20 80 32 WRR ripng-class 26 ripng-scheduler 0 80 16 WRR
- You can use the run show copp statistics command to view the statistics information of the forwarding class, including input and dropped packets and rate.
admin@Xorplus# run show copp statistics All Copp Traffic statistics: Input rate 272 bits/sec, 0 packets/sec Input Packets............................1 Input Octets.............................153 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0 Â arp-class Traffic statistics: forwarding-class state: inactive Input rate 0 bits/sec, 0 packets/sec Input Packets............................0 Input Octets.............................0 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0 copp-class1 Traffic statistics: forwarding-class state: active Input rate 0 bits/sec, 0 packets/sec Input Packets............................0 Input Octets.............................0 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0 Â copp-class2 Traffic statistics: forwarding-class state: active Input rate 0 bits/sec, 0 packets/sec Input Packets............................0 Input Octets.............................0 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0 Â copp-class3 Traffic statistics: forwarding-class state: active Input rate 0 bits/sec, 0 packets/sec Input Packets............................106293 Input Octets.............................19345326 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0 Â copp-class4 Traffic statistics: forwarding-class state: active Input rate 0 bits/sec, 0 packets/sec Input Packets............................0 Input Octets.............................0 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0 ......
- You can use the run show copp statistics active command to view the statistics information of the forwarding class, state of which is active.
admin@Xorplus# run show copp statistics active All Copp Traffic statistics: Input rate 272 bits/sec, 0 packets/sec Input Packets............................1 Input Octets.............................153 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0 Â copp-class1 Traffic statistics: forwarding-class state: active Input rate 0 bits/sec, 0 packets/sec Input Packets............................0 Input Octets.............................0 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0 Â copp-class2 Traffic statistics: forwarding-class state: active Input rate 0 bits/sec, 0 packets/sec Input Packets............................0 Input Octets.............................0 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0 Â copp-class3 Traffic statistics: forwarding-class state: active Input rate 0 bits/sec, 0 packets/sec Input Packets............................106293 Input Octets.............................19345326 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0 Â copp-class4 Traffic statistics: forwarding-class state: active Input rate 0 bits/sec, 0 packets/sec Input Packets............................0 Input Octets.............................0 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0
- You can use the run show copp statistics forwarding-class command to view the statistics information of the specified forwarding class.
admin@Xorplus# run show copp statistics forwarding-class copp-class1 copp-class1 Traffic statistics: forwarding-class state: active Input rate 0 bits/sec, 0 packets/sec Input Packets............................0 Input Octets.............................0 Drop rate 0 bits/sec, 0 packets/sec Drop Packets.............................0 Drop Octets..............................0
- You can use the run show interface stm command to view the total STM resources that are available and how many STM entries are in use. The item number of firewall egress tables is used for describing STM resources of CoPP. By default, the value of number of firewall egress tables in Stm resource in use: is 21 as have been used by the default CoPP configurations.
admin@Xorplus# run show interface stm Total stm resource: Share-mode: 5 number of host routes: 32768 number of mac unicast addresses: 32768 number of firewall ingress tables: 896 number of firewall egress tables: 510 number of IPv4 unicast routes: 5000 number of IPv6 unicast routes: 500 Stm resource in use: number of firewall ingress tables: 2 number of firewall egress tables: 29
- You can use the run clear copp statistics command to clear the past statistics information of CoPP policy.
admin@Xorplus# run clear copp statistics admin@Xorplus# commit
Copyright © 2024 Pica8 Inc. All Rights Reserved.