300-410 Control Plane Policing (CoPP) — 30 Questions

Question 1

A network engineer notices that BGP sessions between two directly connected routers are flapping every few minutes. The routers are running IOS-XE 17.3 and have CoPP enabled. The engineer checks the CoPP policy and sees a class-map matching BGP packets with a police rate of 8000 bps. The BGP session uses MD5 authentication and the routers exchange a full BGP table with 500,000 prefixes. What is the most likely cause of the BGP session flapping?

Accepted Answer

The CoPP police rate of 8000 bps is too low for the BGP keepalive and update traffic, causing packet drops.. The CoPP policy is policing BGP control plane packets at a rate of 8000 bps, which is insufficient for the BGP keepalive and update traffic. BGP keepalives are sent every 60 seconds by default, but with 500,000 prefixes, the initial BGP update traffic can easily exceed 8000 bps, causing packets to be dropped and the session to flap.

Answer

The BGP MD5 authentication is causing excessive CPU utilization, triggering CoPP drops.

Answer

The CoPP class-map is not matching BGP packets correctly because it uses a wrong access-list.

Answer

The BGP hold timer is set too low, causing the session to reset before CoPP drops are noticed.

Question 2

A router experiences high CPU utilization due to SSH login attempts from an external attacker. The network engineer implements a CoPP policy to rate-limit SSH traffic to 10000 bps. After applying the policy, the engineer notices that legitimate SSH sessions from the management network are also being dropped intermittently. The CoPP policy uses a class-map that matches TCP port 22 traffic. What should the engineer do to fix this issue?

Accepted Answer

Create a separate class for legitimate SSH traffic from the management network with a higher police rate, and police the attacker's traffic more aggressively.. The CoPP policy is rate-limiting all SSH traffic, including legitimate sessions. The engineer should create a more specific class-map that matches only the attacker's source IP addresses or uses a more granular approach, such as matching traffic from the management network with a higher police rate.

Answer

Increase the police rate for the SSH class to 100000 bps to allow all SSH traffic.

Answer

Modify the class-map to match only SSH traffic from the attacker's source IP addresses using an access-list.

Answer

Remove the CoPP policy and implement an ACL on the interface to block the attacker's IP address.

Question 3

An engineer applies a CoPP policy to a router to protect the control plane. The policy includes a class-map that matches all ICMP traffic and polices it to 5000 bps. After the policy is applied, the engineer notices that OSPF adjacencies are going down. The OSPF hello packets are not being received. What is the most likely cause?

Accepted Answer

The CoPP policy has a default class that drops all unmatched traffic, including OSPF packets.. OSPF uses IP protocol 89, not ICMP. However, if the class-map is misconfigured to match all IP traffic or if there is a default class that drops packets, OSPF packets might be affected. The most likely cause is that the CoPP policy has a default class that drops unmatched traffic, including OSPF packets.

Answer

The CoPP policy is policing OSPF packets because the class-map matches all IP traffic, not just ICMP.

Answer

The OSPF hello packets are being rate-limited because they are ICMP packets.

Answer

The CoPP policy is applied to the wrong interface, causing OSPF packets to be dropped.

Question 4

A router running EIGRP has a CoPP policy that includes a class-map matching EIGRP packets with a police rate of 2000 bps. The network engineer notices that EIGRP neighbor adjacencies are flapping. The EIGRP network has 100 routes. The engineer checks the CoPP statistics and sees that the EIGRP class has dropped 500 packets in the last hour. What is the most likely root cause?

Accepted Answer

The CoPP police rate of 2000 bps is insufficient for EIGRP hello and update traffic, causing packet drops.. EIGRP hello packets are small and sent every 5 seconds by default. With 100 routes, the update traffic is also small. However, if the police rate is too low, even small packets can be dropped. The drop count of 500 packets in an hour indicates that EIGRP packets are being policed, causing adjacencies to flap.

Answer

The EIGRP hello interval is set too low, causing excessive hello packets that exceed the police rate.

Answer

The EIGRP authentication is causing larger packets that exceed the police rate.

Answer

The CoPP class-map is matching EIGRP packets incorrectly, causing them to be dropped by a default class.

Question 5

A network engineer configures CoPP on a router to limit PIM-SM control plane traffic. The policy includes a class-map matching PIM packets and polices them to 10000 bps. After the policy is applied, the engineer notices that multicast traffic is not being forwarded correctly, and PIM neighbors are not forming. The router is a PIM-SM rendezvous point (RP). What is the most likely issue?

Accepted Answer

The CoPP policy is dropping PIM register messages because the police rate is too low for the burst of register traffic.. PIM-SM uses periodic hello messages and register messages that can be large. If the police rate is too low, PIM packets are dropped, preventing neighbor formation and RP discovery. Additionally, the RP might need to process register messages, which can be bursty.

Answer

The CoPP class-map is not matching PIM packets because it uses the wrong protocol number.

Answer

The PIM hello interval is set too high, causing the router to miss hello packets from neighbors.

Answer

The CoPP policy is applied to the wrong control plane, such as the IPv6 control plane.

Question 6

A router has a CoPP policy that includes a class-map matching all TCP traffic with a police rate of 5000 bps. The engineer notices that Telnet sessions to the router are timing out, but SSH sessions work fine. The router is configured to accept both Telnet and SSH. What is the most likely cause?

Accepted Answer

The CoPP policy has a separate class for Telnet with a lower police rate or a drop action.. Both Telnet and SSH use TCP, so they should both be affected by the same police rate. However, if the CoPP policy has separate classes for Telnet and SSH, or if the police rate is applied per class, the issue might be that Telnet traffic is being policed more aggressively. Alternatively, the Telnet traffic might be hitting a different class that drops it.

Answer

The SSH traffic is encrypted, so it uses less bandwidth than Telnet.

Answer

The Telnet server on the router is not responding due to a configuration error.

Answer

The CoPP policy is rate-limiting TCP traffic to 5000 bps, which is enough for SSH but not for Telnet.

Question 7

An engineer applies a CoPP policy to a router to protect the control plane from a DDoS attack. The policy includes a class-map matching UDP traffic to port 123 (NTP) and polices it to 1000 bps. After the policy is applied, the engineer notices that the router's clock is not synchronizing with its NTP server. The NTP server is reachable via ping. What is the most likely cause?

Accepted Answer

The CoPP policy is dropping NTP packets because the police rate is too low.. NTP uses UDP port 123. The CoPP policy is rate-limiting NTP traffic to 1000 bps, which may be too low for NTP packets, especially if there are multiple NTP packets or if the burst is high. This causes NTP packets to be dropped, preventing clock synchronization.

Answer

The NTP server is not responding because of the DDoS attack.

Answer

The CoPP class-map is not matching NTP packets because it uses the wrong port number.

Answer

The router's NTP configuration has a wrong server IP address.

Question 8

A router has a CoPP policy that includes a class-map matching all traffic from a specific source IP address (the management station) and polices it to 100000 bps. The engineer notices that SNMP polls from the management station are timing out. The SNMP traffic uses UDP port 161. The engineer checks the CoPP statistics and sees that the class for the management station has dropped packets. What is the most likely cause?

Accepted Answer

The CoPP police rate of 100000 bps is too low for the SNMP traffic from the management station.. The CoPP policy is rate-limiting traffic from the management station to 100000 bps. SNMP polls can generate bursts of traffic, especially if the router has many OIDs to query. If the police rate is too low for the SNMP traffic, packets are dropped, causing timeouts.

Answer

The SNMP community string is incorrect on the management station.

Answer

The CoPP class-map is matching the wrong source IP address.

Answer

The SNMP agent on the router is not responding due to high CPU.

Question 9

A network engineer configures CoPP on a router to limit ICMP traffic to 5000 bps. After the policy is applied, the engineer notices that the router is not responding to ping requests from a remote network. However, the router can ping other devices successfully. The engineer checks the CoPP statistics and sees that the ICMP class has dropped packets. What is the most likely root cause?

Accepted Answer

The CoPP policy is dropping incoming ICMP echo requests because the police rate is too low.. The CoPP policy is rate-limiting ICMP traffic to 5000 bps. Ping requests from the remote network are ICMP echo requests, which are processed by the control plane. If the rate is too low, these packets are dropped, causing the router to not respond to pings. The router can still originate pings because outgoing ICMP traffic is not subject to CoPP (CoPP applies to incoming control plane traffic).

Answer

The CoPP policy is dropping outgoing ICMP echo replies because the police rate applies to both directions.

Answer

The router's interface ACL is blocking incoming ICMP traffic.

Answer

The router's ICMP rate-limit feature is enabled globally.

Question 10

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-ICMP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 100
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: CoPP-SSH (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 110
      police:
          cir 16000 bps, bc 3000 bytes, be 3000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: class-default (match-any)
      1250 packets, 75000 bytes
      5 minute offered rate 1000 bps, drop rate 0000 bps
      Match: any

Based on this output, which statement is correct?

Accepted Answer

The CoPP policy is not matching any packets for the CoPP-ICMP and CoPP-SSH classes.. The output shows the CoPP policy applied to the control plane. The class-default has traffic, but the specific classes (ICMP and SSH) show zero packets, indicating the access-lists may not be matching traffic or the class-maps are not correctly configured. The correct answer is that the CoPP policy is not matching any packets for the defined classes.

Answer

The CoPP policy is dropping all ICMP packets to the control plane.

Answer

The CoPP policy is rate-limiting SSH traffic to 16000 bps.

Answer

The CoPP policy is applied to the output direction.

Question 11

A network engineer runs the following command on Router R1:

R1# show access-lists 100

Extended IP access list 100
    10 permit icmp any any echo
    20 permit icmp any any echo-reply
    30 permit icmp any any time-exceeded
    40 permit icmp any any unreachable

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-ICMP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 100
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what is the most likely problem?

Accepted Answer

The access-list does not include all ICMP types that may be sent to the control plane.. The access-list 100 matches ICMP types, but the class-map CoPP-ICMP uses 'match-all' which requires all match criteria to be met. Since only one access-group is referenced, 'match-all' is not incorrect, but the access-list may not be matching the actual ICMP traffic types sent to the control plane (e.g., ICMP type 8 for echo, but the router may receive other types). However, the key issue is that the class-map is not matching any packets, likely because the access-list is incomplete or the traffic is not matching the specified ICMP types.

Answer

The class-map uses 'match-all' instead of 'match-any'.

Answer

The police rate is too low and is dropping all packets.

Answer

The policy-map is applied to the wrong direction.

Question 12

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-BGP (match-all)
      500 packets, 30000 bytes
      5 minute offered rate 1000 bps, drop rate 500 bps
      Match: access-group 120
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 300 packets, 18000 bytes; actions:
          transmit
        exceeded 100 packets, 6000 bytes; actions:
          drop
        violated 100 packets, 6000 bytes; actions:
          drop

Based on this output, which statement is correct?

Accepted Answer

BGP traffic is being rate-limited and some packets are being dropped.. The CoPP-BGP class is matching traffic and applying a police rate. The drop rate is 500 bps, and there are exceeded and violated packets being dropped. This indicates that BGP traffic is being rate-limited and some packets are being dropped, which could cause BGP session instability.

Answer

All BGP packets are being transmitted without any drops.

Answer

The police rate is set to 16000 bps.

Answer

The class-default is matching BGP traffic.

Question 13

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-SNMP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 130
      police:
          cir 32000 bps, bc 6000 bytes, be 6000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

R1# show access-lists 130

Extended IP access list 130
    10 permit udp any any eq snmp
    20 permit udp any any eq snmptrap

Based on this output, what is the most likely reason that no packets are matching the CoPP-SNMP class?

Accepted Answer

The SNMP traffic is being sent from the router itself, which is not processed through the input control plane policy.. The access-list 130 matches SNMP traffic (UDP ports 161 and 162). However, SNMP traffic to the router itself typically uses the control plane, but the access-list may not match if the traffic is sourced from the router (e.g., SNMP traps) or if the source/destination IPs are not 'any'. The most common issue is that the access-list does not specify the direction of traffic, but since it is applied to the control plane input, it should match incoming SNMP requests. However, if the router is sending SNMP traps, those are output traffic. The problem could be that the access-list is not matching the actual SNMP traffic because the router's own SNMP agent traffic is not subject to CoPP. But the key clue is that the class is not matching any packets, indicating the access-list may not be correct for the traffic type.

Answer

The access-list does not include the correct SNMP port numbers.

Answer

The police rate is too low and is dropping all packets before counting.

Answer

The class-map is using 'match-all' instead of 'match-any'.

Question 14

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-OSPF (match-all)
      1000 packets, 60000 bytes
      5 minute offered rate 2000 bps, drop rate 0000 bps
      Match: access-group 140
      police:
          cir 64000 bps, bc 12000 bytes, be 12000 bytes
        conformed 1000 packets, 60000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, which statement is correct?

Accepted Answer

OSPF traffic is being transmitted without any drops.. The CoPP-OSPF class is matching OSPF traffic and all packets are conforming to the police rate, so no drops are occurring. This indicates that OSPF traffic is being properly rate-limited without any packet loss.

Answer

OSPF packets are being dropped due to exceeding the police rate.

Answer

The police rate is set to 32000 bps.

Answer

The class-default is matching OSPF traffic.

Question 15

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-DEFAULT (match-any)
      5000 packets, 300000 bytes
      5 minute offered rate 4000 bps, drop rate 2000 bps
      Match: any
      police:
          cir 32000 bps, bc 6000 bytes, be 6000 bytes
        conformed 3000 packets, 180000 bytes; actions:
          transmit
        exceeded 1000 packets, 60000 bytes; actions:
          drop
        violated 1000 packets, 60000 bytes; actions:
          drop

Based on this output, what is the most likely impact on the router?

Accepted Answer

Some control plane traffic is being dropped, which could cause routing protocol instability.. The class-default is matching all traffic not matched by other classes, and it is rate-limiting with a CIR of 32000 bps. Since there are drops, some control plane traffic (e.g., routing updates, management traffic) may be dropped, potentially causing issues like BGP session flapping or SSH timeouts.

Answer

All control plane traffic is being transmitted without issues.

Answer

The police rate is set to 64000 bps.

Answer

Only ICMP traffic is being dropped.

Question 16

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-EIGRP (match-all)
      200 packets, 12000 bytes
      5 minute offered rate 1000 bps, drop rate 0000 bps
      Match: access-group 150
      police:
          cir 16000 bps, bc 3000 bytes, be 3000 bytes
        conformed 200 packets, 12000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

R1# show ip eigrp neighbors
EIGRP-IPv4 neighbors for process 100
H   Address                 Interface       Hold Uptime    SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   10.1.1.2                Gi0/0            13 00:10:00    1   200  0  5

Based on this output, which statement is correct?

Accepted Answer

EIGRP traffic is being rate-limited but no packets are dropped.. The CoPP-EIGRP class is matching EIGRP traffic and all packets are conforming. The EIGRP neighbor is established and stable, indicating that the CoPP policy is not negatively impacting EIGRP.

Answer

EIGRP packets are being dropped, causing neighbor flapping.

Answer

The police rate is set to 8000 bps.

Answer

The EIGRP neighbor is not established.

Question 17

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-BGP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 120
      police:
          cir 32000 bps, bc 6000 bytes, be 6000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

R1# show ip bgp summary
BGP router identifier 1.1.1.1, local AS number 100
BGP table version is 1, main routing table version 1
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.1.2        4          200      10      10        1    0    0 00:05:00        5

Based on this output, what is the most likely problem?

Accepted Answer

The access-list 120 is not matching BGP traffic, so it is falling into class-default.. The CoPP-BGP class shows zero packets, but the BGP session is established and exchanging messages. This indicates that BGP traffic is not being classified by the CoPP-BGP class, likely because the access-group 120 is not matching the BGP packets. The BGP session is up, so the traffic is being processed by the class-default instead.

Answer

The BGP session is down.

Answer

The police rate is too low and is dropping all BGP packets.

Answer

The policy-map is applied to the output direction.

Question 18

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-ICMP (match-all)
      100 packets, 6000 bytes
      5 minute offered rate 500 bps, drop rate 500 bps
      Match: access-group 100
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 50 packets, 3000 bytes; actions:
          transmit
        exceeded 25 packets, 1500 bytes; actions:
          drop
        violated 25 packets, 1500 bytes; actions:
          drop

Based on this output, what is the most likely impact on the router?

Accepted Answer

ICMP traffic is being rate-limited, causing some ping requests to fail.. The CoPP-ICMP class is dropping half of the ICMP packets due to exceeding the police rate. This could cause ping failures or traceroute issues from network devices, but it is not necessarily critical for router operation. However, it indicates that ICMP traffic is being rate-limited.

Answer

All ICMP packets are being transmitted without drops.

Answer

The police rate is set to 16000 bps.

Answer

The class-default is matching ICMP traffic.

Question 19

Examine the following CoPP configuration on a Cisco IOS-XE router:

!--- ACL to match traffic
access-list 100 permit tcp any any eq 22
access-list 100 permit tcp any any eq 23
access-list 100 permit icmp any any echo
!
!--- Class-map
class-map match-all COPP-MGMT
 match access-group 100
!
!--- Policy-map
policy-map COPP-POLICY
 class COPP-MGMT
  police 8000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
!--- Apply to control-plane
control-plane
 service-policy input COPP-POLICY

What is the effect of this configuration?

Accepted Answer

SSH, Telnet, and ICMP echo packets are rate-limited to 8000 bps; all other control-plane traffic is rate-limited to 64000 bps.. The policy limits SSH, Telnet, and ICMP echo traffic to 8000 bps, dropping excess. All other control-plane traffic is limited to 64000 bps. This protects the router from control-plane overload.

Answer

Only SSH and Telnet are rate-limited to 8000 bps; ICMP echo is not affected because it is matched by a different class.

Answer

All control-plane traffic is rate-limited to 64000 bps, because the class-default overrides the COPP-MGMT class.

Answer

The configuration is invalid because the class-map must be named 'COPP-CLASS' to be used in the policy-map.

Question 20

Consider the following CoPP configuration:

class-map match-any COPP-ROUTING
 match protocol ospf
 match protocol eigrp
 match protocol bgp
!
policy-map COPP-POLICY
 class COPP-ROUTING
  police 32000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

What is a potential issue with this configuration?

Accepted Answer

The 'match protocol' command is not supported in CoPP class-maps; only ACLs or DSCP/IP precedence can be used.. Using match protocol in a class-map for CoPP is not supported; CoPP only matches on ACLs or DSCP/IP precedence. The policy will not classify routing protocol traffic correctly.

Answer

The class-map uses match-any instead of match-all, which will cause incorrect matching.

Answer

The police rate of 32000 bps is too low for routing protocol traffic and may cause adjacency drops.

Answer

The policy-map must be applied to the control-plane with the 'output' keyword instead of 'input'.