Wednesday, June 17, 2020

CoPP Confusion

I'm having trouble understanding how traffic is matching on a class-map that doesn't have a match condition.

ip access-list extended EIGRP-CUSTOM permit eigrp any any ! class-map match-all EIGRP-CUSTOM match access-group name EIGRP-CUSTOM ! class-map match-any class-copp-mcast-punt ! class-map match-any class-copp-mcast-v4-data-on-routedPort ! policy-map TEST class class-copp-mcast-v4-data-on-routedPort police rate 10 pps burst 1 packets conform-action drop exceed-action drop class class-copp-mcast-punt police rate 1000 pps burst 256 packets conform-action transmit exceed-action drop class EIGRP-CUSTOM police cir 200000000 bc 31250 conform-action transmit exceed-action transmit control-plane service-policy input TEST 

I've inherited this configuration (it's a subset of a larger config that I can't share). But essentially, I can still see traffic being matched on the class-copp-mcast-v4-data-on-routedPort class. How is that possible. Please see the below, as I have an increasing counter on the "exceeded packets" section .

show policy-map control-plane input class-map: class-copp-mcast-v4-data-on-routedPort (match-any) ..output omitted cos it's irrelevant Earl in slot 2 : 633577 packets 5 minute offered rate 0 pps aggregate-forwarded 2 packets action: drop exceeded 633575 packets action: drop aggregate-forward 0 pps exceed 0 pps 

I'm assuming that this is some sort of auto-generated policy, thats then been inheterited into a new custom policy, and this auto-generated policy is somehow in the background matching the traffic or something, I don't know. Can someone explain?



No comments:

Post a Comment