Networking Requirements

In order to protect switch CPU from attacks and being overloaded by control plane packets, maintaining data forwarding and network topology stability, configure different CoPP policy for flows of different control plane protocols: SSH, NTP, TFTP and SLOW.

Procedure

Step1 Configure CoPP queue mapping, scheduling weight, scheduling algorithm and queue shaping.

admin@Xorplus# set class-of-service scheduler copp-scheduler180 mode WRR
admin@Xorplus# set class-of-service scheduler copp-scheduler180 max-bandwidth-pps 180
admin@Xorplus# set class-of-service scheduler copp-scheduler180 min-bandwidth-pps 0
admin@Xorplus# set class-of-service scheduler copp-scheduler180 weight 5
admin@Xorplus# set class-of-service scheduler-profile copp-profile forwarding-class copp-class1 scheduler copp-scheduler180
admin@Xorplus# set class-of-service scheduler-profile copp-profile forwarding-class copp-class2 scheduler copp-scheduler180
 
admin@Xorplus# set class-of-service scheduler copp-scheduler200 mode WRR
admin@Xorplus# set class-of-service scheduler copp-scheduler200 max-bandwidth-pps 200
admin@Xorplus# set class-of-service scheduler copp-scheduler200 min-bandwidth-pps 0
admin@Xorplus# set class-of-service scheduler copp-scheduler200 weight 10
admin@Xorplus# set class-of-service scheduler-profile copp-profile forwarding-class copp-class3 scheduler copp-scheduler200
 
admin@Xorplus# set class-of-service scheduler copp-scheduler300 mode WRR
admin@Xorplus# set class-of-service scheduler copp-scheduler300 max-bandwidth-pps 300
admin@Xorplus# set class-of-service scheduler copp-scheduler300 min-bandwidth-pps 0
admin@Xorplus# set class-of-service scheduler copp-scheduler300 weight 20
admin@Xorplus# set class-of-service scheduler-profile copp-profile forwarding-class copp-class4 scheduler copp-scheduler300

#Configure a policer 50pps.

admin@Xorplus# set firewall policer 50pps if-exceeding rate-limit 50
admin@Xorplus# set firewall policer 50pps if-exceeding burst-limit 50

#Configure mapping between forwarding class and local priority.

admin@Xorplus# set class-of-service forwarding-class copp-class1 local-priority 1
admin@Xorplus# set class-of-service forwarding-class copp-class2 local-priority 2
admin@Xorplus# set class-of-service forwarding-class copp-class3 local-priority 3
admin@Xorplus# set class-of-service forwarding-class copp-class4 local-priority 4

Step2 Configure destination-port and protocol to classify SSH flow, and mapping to forwarding class copp-class3.

admin@Xorplus# set firewall filter copp sequence 83 from destination-port 22
admin@Xorplus# set firewall filter copp sequence 83 from protocol tcp
admin@Xorplus# set firewall filter copp sequence 83 then forwarding-class copp-class3
admin@Xorplus# set firewall filter copp sequence 83 then policer 50pps
 
admin@Xorplus# set firewall filter copp sequence 84 from source-port 22
admin@Xorplus# set firewall filter copp sequence 84 from protocol tcp
admin@Xorplus# set firewall filter copp sequence 84 then forwarding-class copp-class3
admin@Xorplus# set firewall filter copp sequence 84 then policer 50pps

Step3 Configure destination-port, protocol and ether-type to classify NTP (Network Time Protocol) flow, and mapping to forwarding class copp-class1.

admin@Xorplus# set firewall filter copp sequence 91 from destination-port 123
admin@Xorplus# set firewall filter copp sequence 91 from protocol udp
admin@Xorplus# set firewall filter copp sequence 91 then forwarding-class copp-class1
 
admin@Xorplus# set firewall filter copp sequence 92 from destination-port 123
admin@Xorplus# set firewall filter copp sequence 92 from ether-type 34525
admin@Xorplus# set firewall filter copp sequence 92 from protocol udp
admin@Xorplus# set firewall filter copp sequence 92 then forwarding-class copp-class1

Step4 Configure destination-port, protocol and ether-type to classify TFTP flow, and mapping to forwarding class copp-class2.

admin@Xorplus# set firewall filter copp sequence 108 from destination-port 69
admin@Xorplus# set firewall filter copp sequence 108 from protocol udp
admin@Xorplus# set firewall filter copp sequence 108 then forwarding-class copp-class2
 
admin@Xorplus# set firewall filter copp sequence 109 from source-port 69
admin@Xorplus# set firewall filter copp sequence 109 from protocol udp
admin@Xorplus# set firewall filter copp sequence 109 then forwarding-class copp-class2

Step5 Configure destination-mac-address and ether-type to classify SLOW flow, and mapping to forwarding class copp-class4.

admin@Xorplus# set firewall filter copp sequence 111 from destination-mac-address 01:80:C2:00:00:02
admin@Xorplus# set firewall filter copp sequence 111 from ether-type 34825
admin@Xorplus# set firewall filter copp sequence 111 then forwarding-class copp-class4

Step6 Commit the configuration.

admin@XorPlus# commit

Verify the Configuration

You can use the run show copp bandwidth command to view the bandwidth information, scheduling information and local priority of the forwarding class.

admin@Xorplus# run show copp bandwidth
Forwarding Class  Min-Bandwidth Max-Bandwidth Weight Local-Priority Schedule-Mode
default-class        0            100          24     0              WRR         
copp-class1          0            180          5      1              WRR         
copp-class2          0            180          5      2              WRR         
copp-class3          0            200          10     3              WRR         
copp-class4          0            300          20     4              WRR          
pim-class            0            80           16     8              WRR         
igmp-class           0            80           16     9              WRR         
vrrp-class           0            80           16     10             WRR         
dhcp-class           0            80           16     11             WRR         
rip-class            0            80           16     12             WRR         
ospf-class           0            80           16     13             WRR         
bgp-class            0            80           16     14             WRR         
mlag-mac-sync-class  0            80           16     15             WRR
mlag-class           0            80           16     16             WRR         
bfd-class            0            80           16     17             WRR         
arp-class            20           80           32     18             WRR  
arp-class            20           80           32     19             WRR  
lldp-class           20           80           32     20             WRR         
lacp-class           20           80           32     21             WRR         
bpdu-class           20           80           32     22             WRR
management-class     20           80           12     23             WRR     
mvrp-class           100          500          32     24             WRR
erps-class           100          500          32     25             WRR
ripng-class          0            500          16     26             WRR

You can use the run show filter copp command to view the configuration information of all CoPP policies, both pre-defined and user-defined, and match counter.

admin@Xorplus# run show filter copp
       Filter: copp
           Description:
           Sequence: 10
               Description:
               match counter:  0 packets
               match-condition:
                  protocol:                 bpdu
               action: forward
               forwarding_class: bpdu-class
              ......
           Sequence: 81
               Description:
               match counter:  0 packets
               match-condition:
                  destination-port:         23..23
                  protocol:                 tcp
               action: forward
               forwarding_class: copp-class3
           Sequence: 82
               Description:
               match counter:  0 packets
               match-condition:
                  destination-port:         107..107
                  protocol:                 tcp
               action: forward
               forwarding_class: copp-class3
               policer: 50pps
           Sequence: 83
               Description:
               match counter:  0 packets
               match-condition:
                  destination-port:         22..22
                  protocol:                 tcp
               action: forward
               forwarding_class: copp-class3
               policer: 50pps
           Sequence: 84
               Description:
               match counter:  0 packets
               match-condition:
                  protocol:                 tcp
                  source-port:              22..22
               action: forward
               forwarding_class: copp-class3
               policer: 50pps
           Sequence: 90
               Description:
               match counter:  0 packets
               match-condition:
                  protocol:                 dhcp
               action: forward
               forwarding_class: dhcp-class
           Sequence: 91
               Description:
               match counter:  0 packets
               match-condition:
                  destination-port:         123..123
                  protocol:                 udp
               action: forward
               forwarding_class: copp-class1
           Sequence: 92
               Description:
               match counter:  0 packets
               match-condition:
                  destination-port:         123..123
                  ether-type:               0x86dd
                  protocol:                 udp
               action: forward
               forwarding_class: copp-class1
           Sequence: 100
               Description:
               match counter:  0 packets
               match-condition:
                  protocol:                 vrrp
               action: forward
               forwarding_class: vrrp-class
           Sequence: 108
               Description:
               match counter:  0 packets
               match-condition:
                  destination-port:         69..69
                  protocol:                 udp
               action: forward
               forwarding_class: copp-class2
           Sequence: 109
               Description:
               match counter:  0 packets
               match-condition:
                  protocol:                 udp
                  source-port:              69..69
               action: forward
               forwarding_class: copp-class2
           Sequence: 110
               Description:
               match counter:  0 packets
               match-condition:
                  protocol:                 igmp
               action: forward
               forwarding_class: igmp-class
           Sequence: 111
               Description:
               match counter:  0 packets
               match-condition:
                  destination-mac-address:  01:80:c2:00:00:02
                  ether-type:               0x8809
               action: forward
               forwarding_class: copp-class4
           ......
        Input interface: inbound-control-plane

You can use the run show class-of-service interface inbound-control-plane command to view the detail configuration information of CoPP profile.

admin@Xorplus# run show class-of-service interface inbound-control-plane
Interface : inbound-control-plane
Scheduler-profile : copp-profile
Forwarding-class     Local-priority   Scheduler               Min-Bandwidth   Max-Bandwidth   Weight   Schedule-Mode
------------------   --------------   ---------------------   -------------   -------------   ------   -------------
default-class        0                default-scheduler       0               80              8        WRR         
pim-class            8                pim-scheduler           0               80              16       WRR         
igmp-class           9                igmp-scheduler          0               80              16       WRR         
vrrp-class           10               vrrp-scheduler          0               80              16       WRR         
dhcp-class           11               dhcp-scheduler          0               80              16       WRR         
rip-class            12               rip-scheduler           0               80              16       WRR         
ospf-class           13               ospf-scheduler          0               80              16       WRR         
bgp-class            14               bgp-scheduler           0               80              16       WRR         
mlag-mac-sync-class  15               mlag-mac-sync-scheduler 0               80              16       WRR         
mlag-class           16               mlag-scheduler          0               80              16       WRR         
bfd-class            17               bfd-scheduler           0               80              16       WRR
ndp-class            18               arp-scheduler           20              80              32       WRR                  
arp-class            19               arp-scheduler           20              80              32       WRR         
lldp-class           20               lldp-scheduler          20              80              32       WRR         
lacp-class           21               lacp-scheduler          20              80              32       WRR         
bpdu-class           22               bpdu-scheduler          20              80              32       WRR
management-class     23               management-scheduler    20              80              12       WRR     
mvrp-class           24               mvrp-scheduler          20              80              32       WRR
erps-class           25               erps-scheduler          20              80              32       WRR
ripng-class          26               ripng-scheduler         0               80              16       WRR

You can use the run show copp statistics command to view the statistics information of the forwarding class, including input and dropped packets and rate.

admin@Xorplus# run show copp statistics
All Copp Traffic statistics:
Input rate 272 bits/sec, 0 packets/sec
Input Packets............................1
Input Octets.............................153
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0
 
arp-class Traffic statistics:
forwarding-class state: inactive
Input rate 0 bits/sec, 0 packets/sec
Input Packets............................0
Input Octets.............................0
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0

copp-class1 Traffic statistics:
forwarding-class state: active
Input rate 0 bits/sec, 0 packets/sec
Input Packets............................0
Input Octets.............................0
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0
 
copp-class2 Traffic statistics:
forwarding-class state: active
Input rate 0 bits/sec, 0 packets/sec
Input Packets............................0
Input Octets.............................0
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0
 
copp-class3 Traffic statistics:
forwarding-class state: active
Input rate 0 bits/sec, 0 packets/sec
Input Packets............................106293
Input Octets.............................19345326
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0
 
copp-class4 Traffic statistics:
forwarding-class state: active
Input rate 0 bits/sec, 0 packets/sec
Input Packets............................0
Input Octets.............................0
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0
......

You can use the run show copp statistics active command to view the statistics information of the forwarding class, state of which is active.

admin@Xorplus# run show copp statistics active
All Copp Traffic statistics:
Input rate 272 bits/sec, 0 packets/sec
Input Packets............................1
Input Octets.............................153
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0
 

copp-class1 Traffic statistics:
forwarding-class state: active
Input rate 0 bits/sec, 0 packets/sec
Input Packets............................0
Input Octets.............................0
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0
 
copp-class2 Traffic statistics:
forwarding-class state: active
Input rate 0 bits/sec, 0 packets/sec
Input Packets............................0
Input Octets.............................0
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0
 
copp-class3 Traffic statistics:
forwarding-class state: active
Input rate 0 bits/sec, 0 packets/sec
Input Packets............................106293
Input Octets.............................19345326
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0
 
copp-class4 Traffic statistics:
forwarding-class state: active
Input rate 0 bits/sec, 0 packets/sec
Input Packets............................0
Input Octets.............................0
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0

You can use the run show copp statistics forwarding-class command to view the statistics information of the specified forwarding class.

admin@Xorplus# run show copp statistics forwarding-class copp-class1
copp-class1 Traffic statistics:

forwarding-class state: active
Input rate 0 bits/sec, 0 packets/sec
Input Packets............................0
Input Octets.............................0
Drop rate 0 bits/sec, 0 packets/sec
Drop Packets.............................0
Drop Octets..............................0

You can use the run show interface stm command to view the total STM resources that are available and how many STM entries are in use. The item number of firewall egress tables is used for describing STM resources of CoPP. By default, the value of number of firewall egress tables in Stm resource in use: is 21 as have been used by the default CoPP configurations.

admin@Xorplus# run show interface stm
Total stm resource:
  Share-mode: 5
  number of host routes: 32768
  number of mac unicast addresses: 32768 
  number of firewall ingress tables: 896
  number of firewall egress tables: 510
  number of IPv4 unicast routes: 5000
  number of IPv6 unicast routes: 500
Stm resource in use:
  number of firewall ingress tables: 2
  number of firewall egress tables: 29

You can use the run clear copp statistics command to clear the past statistics information of CoPP policy.

admin@Xorplus# run clear copp statistics
admin@Xorplus# commit

Browser not supported