WEBVTT

1
00:00.000 --> 00:04.480
As we turn our attention to the control plane policing feature that can help

2
00:04.480 --> 00:06.000
protect our infrastructure devices,

3
00:06.000 --> 00:10.670
let's leave our infrastructure ACL inbound that we created previously right

4
00:10.670 --> 00:12.000
here. So currently,

5
00:12.000 --> 00:20.100
server one dash nug can get to our one at 25 dot 25 dot 25 dot one. And we can

6
00:20.100 --> 00:21.440
log in as admin using

7
00:21.440 --> 00:25.140
SSH and that works because the infrastructure ACL is letting it. So as an

8
00:25.140 --> 00:26.400
additional level of

9
00:26.400 --> 00:32.340
protection regarding access to router one via SSH, we could also go ahead and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:26.400 --> 00:32.340
protection regarding access to router one via SSH, we could also go ahead and

10
00:32.340 --> 00:33.600
use control plane

11
00:33.600 --> 00:37.940
policing. And here's the three elements of control plane policing. Number one,

12
00:37.940 --> 00:38.880
identify the traffic,

13
00:38.880 --> 00:43.540
which is done with an access control list in combination with a class map. So

14
00:43.540 --> 00:44.160
that's step number

15
00:44.160 --> 00:48.250
one. So step number two would be to go ahead and identify what actually want to

16
00:48.250 --> 00:49.520
take on that traffic.

17
00:49.520 --> 00:54.240
And that is specified with a policy map. And that policy map is calling upon

18
00:54.240 --> 00:54.880
the class map to

19
00:54.880 --> 00:58.510
identify what traffic to take that action upon. So let's imagine the access

20
00:58.510 --> 00:59.440
control list and the

21
00:59.440 --> 01:03.600
class map are looking for SSH traffic. And then in the policy map, what we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:59.440 --> 01:03.600
class map are looking for SSH traffic. And then in the policy map, what we

22
01:03.600 --> 01:04.800
could say is we could

23
01:04.800 --> 01:08.220
limit that traffic to a certain amount, or we could just go ahead in the policy

24
01:08.220 --> 01:08.800
map and say,

25
01:08.800 --> 01:13.280
if we see it, drop it. And then the third step is to specify where we want to

26
01:13.280 --> 01:14.240
apply effectively

27
01:14.240 --> 01:19.150
that policy map. So step number three is where to apply it. And in the case of

28
01:19.150 --> 01:20.160
control plane

29
01:20.160 --> 01:23.940
policing, we want to apply it to the control plane. Like think of that, like

30
01:23.940 --> 01:25.120
logically inside the

31
01:25.120 --> 01:28.780
brains of the router itself. So no matter where that traffic comes in, if it's

32
01:28.780 --> 01:29.520
coming in here,

33
01:29.520 --> 01:33.850
or here, or here, once it's logically received here at the control plane, we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:29.520 --> 01:33.850
or here, or here, once it's logically received here at the control plane, we

34
01:33.850 --> 01:34.400
can go ahead with

35
01:34.400 --> 01:37.970
the service policy command, apply that policy map, and tell it to go ahead and

36
01:37.970 --> 01:39.040
effectively drop

37
01:39.040 --> 01:43.270
SSH if it sees it. So the command to implement the policy map on the control

38
01:43.270 --> 01:44.240
plane is a command

39
01:44.240 --> 01:47.860
called service policy. And as part of that, we'd refer to the policy map that

40
01:47.860 --> 01:48.880
we created earlier.

41
01:48.880 --> 01:52.720
So to demonstrate this, let's go ahead and use the R one, which is currently

42
01:52.720 --> 01:53.280
receiving

43
01:53.280 --> 01:56.900
SSH connections over here from server one. And let's go ahead and configure

44
01:56.900 --> 01:57.680
control plane

45
01:57.680 --> 02:03.790
policing. So if R one sees that someone is trying to SSH in, it'll go ahead and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:57.680 --> 02:03.790
policing. So if R one sees that someone is trying to SSH in, it'll go ahead and

46
02:03.790 --> 02:04.560
drop it. Now,

47
02:04.560 --> 02:08.810
we also have other mechanisms for controlling that we could say on the VTY

48
02:08.810 --> 02:09.920
lines where people

49
02:09.920 --> 02:14.400
might be trying to come in, we could deny, for example, tell net SSH there, we

50
02:14.400 --> 02:15.040
could also apply

51
02:15.040 --> 02:18.360
access control list that each of the interfaces, but using control plane

52
02:18.360 --> 02:19.520
policing makes it really

53
02:19.520 --> 02:22.930
convenient no matter where that traffic is coming in from to go ahead and drop

54
02:22.930 --> 02:23.840
it. So let me walk

55
02:23.840 --> 02:26.970
you through that right now. In fact, we should start by just still verifying

56
02:26.970 --> 02:27.680
that this server

57
02:27.680 --> 02:33.230
right here can currently SSH over to R one at 252525.1. So let's do that one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:27.680 --> 02:33.230
right here can currently SSH over to R one at 252525.1. So let's do that one

58
02:33.230 --> 02:35.360
first. So back in the lab

59
02:35.360 --> 02:38.790
here at server one, let's go ahead and go back to server one, which is right

60
02:38.790 --> 02:39.920
here. And let's bring

61
02:39.920 --> 02:43.340
up a command prompt. And let's do SSH press center. And just to remind

62
02:43.340 --> 02:44.720
ourselves, we're doing an

63
02:44.720 --> 02:49.190
SSH space that see, and that cipher is going back to our one that cipher was

64
02:49.190 --> 02:50.400
this one right here,

65
02:50.400 --> 02:55.760
AES 128 CBC. So I'll copy that we'll go back to the command prompt. And we'll

66
02:55.760 --> 02:56.240
right click to

67
02:56.240 --> 03:02.160
paste that in space admin 25 dot 25 dot 25 dot one. So I verify before we start
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:56.240 --> 03:02.160
paste that in space admin 25 dot 25 dot 25 dot one. So I verify before we start

68
03:02.160 --> 03:02.560
training control

69
03:02.560 --> 03:06.910
plane policing that it still works at the moment. So we'll log in as admin,

70
03:06.910 --> 03:07.520
supply the password,

71
03:07.520 --> 03:11.790
and we're good to go. So we type in who and show SH, we're good to go. So I'll

72
03:11.790 --> 03:12.640
type in exit,

73
03:12.640 --> 03:15.130
and we'll minimize that because we're going to try that again here in a little

74
03:15.130 --> 03:16.400
bit. So now if

75
03:16.400 --> 03:20.860
you go to our one, which a moment ago was allowing that inbound SSH connection,

76
03:20.860 --> 03:21.440
let's go ahead and

77
03:21.440 --> 03:25.520
create an access control list that identifies SSH traffic. So we'll do a config

78
03:25.520 --> 03:26.000
T. And let's do a

79
03:26.000 --> 03:32.310
named access list IP access dash list extended, and let's call this ACL dash
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:26.000 --> 03:32.310
named access list IP access dash list extended, and let's call this ACL dash

80
03:32.310 --> 03:33.840
match dash SSH. We know

81
03:33.840 --> 03:37.620
exactly what this access control list is going to be doing. And for it, we'll

82
03:37.620 --> 03:39.280
simply say permit

83
03:39.280 --> 03:46.960
TCP any, any equals port 22. So there it is, our one entry in this access

84
03:46.960 --> 03:48.240
control list. So we do a

85
03:48.240 --> 03:53.350
do show access list for that specific ACL and press enter, it has one exact

86
03:53.350 --> 03:54.800
entry and it's line

87
03:54.800 --> 03:59.520
number 10 right there. Fantastic. So the access control list is looking for TCP

88
03:59.520 --> 04:00.560
and layer four
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:59.520 --> 04:00.560
and layer four

89
04:00.560 --> 04:04.800
going from anywhere to anywhere, if the destination port is 22. And then a

90
04:04.800 --> 04:05.680
doesn't match this is going

91
04:05.680 --> 04:09.070
to be an implied deny, meaning not matching this access control list. Let's

92
04:09.070 --> 04:09.920
type in exit and we'll

93
04:09.920 --> 04:13.540
exit configuration mode for that access control list. Next, let's create a

94
04:13.540 --> 04:14.480
class map that calls

95
04:14.480 --> 04:18.560
upon that access control list. And to do that, we'll type in class map space.

96
04:18.560 --> 04:19.280
And then we have a

97
04:19.280 --> 04:23.020
match any or match all. And since we're only matching on one specific access

98
04:23.020 --> 04:23.920
control list,

99
04:23.920 --> 04:26.960
we could actually use match any or match all because we're only looking for one

100
04:26.960 --> 04:27.680
specific match

101
04:27.680 --> 04:31.720
anyway. So I'm gonna say match all space question mark, and then the name. So
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:27.680 --> 04:31.720
anyway. So I'm gonna say match all space question mark, and then the name. So

102
04:31.720 --> 04:32.640
we now have this new

103
04:32.640 --> 04:36.320
class map. And now we need to tell it what to match on. Let's go ahead and do a

104
04:36.320 --> 04:37.200
match space,

105
04:37.200 --> 04:41.030
access group, and a space question mark. And it's the named access list. So we

106
04:41.030 --> 04:41.680
'll go ahead and type

107
04:41.680 --> 04:45.530
in namespace. And then the name of our access control list, which I'm going to

108
04:45.530 --> 04:46.320
scroll up and

109
04:46.320 --> 04:51.220
grab it right here ACL dash match dash SSH. And we'll press center. So now we

110
04:51.220 --> 04:52.640
do a do show class map

111
04:52.640 --> 04:57.610
and press center. We have a class map called CMAP dash SSH that's matching on

112
04:57.610 --> 04:59.120
that ACL match SSH,

113
04:59.120 --> 05:03.950
which is matching on TCP traffic from anywhere to anywhere. If the destination
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:59.120 --> 05:03.950
which is matching on TCP traffic from anywhere to anywhere. If the destination

114
05:03.950 --> 05:04.880
port is 22.

115
05:04.880 --> 05:10.880
So that's the matching part regarding control plane policing. So the second

116
05:10.880 --> 05:11.920
part is to go ahead

117
05:11.920 --> 05:14.840
and say what we want to do with that traffic once we see it. So to do that, we

118
05:14.840 --> 05:15.440
're going to create a

119
05:15.440 --> 05:19.320
policy map. So in configuration mode, we'll type in policy map space. And let's

120
05:19.320 --> 05:20.720
call it P map dash

121
05:20.720 --> 05:25.960
SSH press enter. And we want this policy map to be applicable or applied to any

122
05:25.960 --> 05:26.720
traffic that

123
05:26.720 --> 05:32.250
matches class map C map dash SSH, which is matching on the ACL match SSH. So
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:26.720 --> 05:32.250
matches class map C map dash SSH, which is matching on the ACL match SSH. So

124
05:32.250 --> 05:33.920
long story short too late,

125
05:33.920 --> 05:39.710
I know we're matching on traffic. This destined to part 22. And if we see it

126
05:39.710 --> 05:40.640
here in the policy map

127
05:40.640 --> 05:45.180
is where we specify the action. So as a demonstration, even though we have lots

128
05:45.180 --> 05:46.480
of cool options,

129
05:46.480 --> 05:50.400
I'd like to do a really obvious option of drop, meaning if I see it, I want to

130
05:50.400 --> 05:51.600
drop it. So I'll type

131
05:51.600 --> 05:56.800
in drop press center and it'll type in exit and exit. Let's do a do show policy

132
05:56.800 --> 05:57.760
map. In fact,

133
05:57.760 --> 06:01.130
let's take a look at everything. We'll do a do show access list and I'll type
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
05:57.760 --> 06:01.130
let's take a look at everything. We'll do a do show access list and I'll type

134
06:01.130 --> 06:02.000
it out so a nice and

135
06:02.000 --> 06:07.360
clean ACL dash match dash SSH. That's identifying the traffic and the class map

136
06:07.360 --> 06:08.080
that's calling upon

137
06:08.080 --> 06:13.840
this is called CMAP dash SSH. So do a do show class map and press center. So

138
06:13.840 --> 06:15.200
there's our class

139
06:15.200 --> 06:19.600
map that we created right here. There's also a default class default class map

140
06:19.600 --> 06:20.160
that's right here

141
06:20.160 --> 06:23.570
matching on everything else. But the class map we created is just matching on

142
06:23.570 --> 06:24.400
the ACL, which is

143
06:24.400 --> 06:27.920
matching on SSH. Then our third piece is a do show policy map, we'll press

144
06:27.920 --> 06:29.120
center. And this policy

145
06:29.120 --> 06:33.320
map says if traffic matches this class map, then go ahead and drop it. Now
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
06:29.120 --> 06:33.320
map says if traffic matches this class map, then go ahead and drop it. Now

146
06:33.320 --> 06:35.120
currently, this policy

147
06:35.120 --> 06:38.890
map is not applied anywhere. So we need to apply it and apply this to the

148
06:38.890 --> 06:40.000
control plane. What we're

149
06:40.000 --> 06:43.460
going to do is type in control plane and press enter. Now with the control

150
06:43.460 --> 06:44.560
plane, there's also a

151
06:44.560 --> 06:49.140
feature called control plane protection, not policing and control plane

152
06:49.140 --> 06:51.040
protection allows us to go in

153
06:51.040 --> 06:55.600
in any more granular fashion. So here for the control plane using control plane

154
06:55.600 --> 06:56.400
policing to

155
06:56.400 --> 06:59.920
apply the policy map with some type in service policy, then the direction we

156
06:59.920 --> 07:00.640
want this for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
06:59.920 --> 07:00.640
want this for

157
07:00.640 --> 07:04.810
traffic coming into the control plane space and then the name of our policy map

158
07:04.810 --> 07:06.080
, which is this bad

159
07:06.080 --> 07:11.230
boy right there, pmap dash SSH. And it is done. We have just applied control

160
07:11.230 --> 07:12.560
plane policing.

161
07:13.280 --> 07:17.460
So we do a show policy map control plane and press enter. So there's the

162
07:17.460 --> 07:18.960
command right there.

163
07:18.960 --> 07:23.880
If it sees traffic matching the access control as match SSH, it's then going to

164
07:23.880 --> 07:24.240
go ahead and take

165
07:24.240 --> 07:27.830
the action of dropping it. And then for other traffic that doesn't match that

166
07:27.830 --> 07:28.320
class map,

167
07:28.320 --> 07:32.560
it's going to be permitted by default. So previously, we were able to SSH over
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
07:28.320 --> 07:32.560
it's going to be permitted by default. So previously, we were able to SSH over

168
07:32.560 --> 07:33.120
to R1,

169
07:33.120 --> 07:36.900
but now check this out. Currently, we have a hit count of zero packets matching

170
07:36.900 --> 07:37.760
that class map.

171
07:37.760 --> 07:40.900
And now if we go back to the command prompt and hit the up arrow key and do

172
07:40.900 --> 07:42.960
that same SSH once again,

173
07:42.960 --> 07:46.630
even though the infrastructure ACL is allowing this to happen, the control

174
07:46.630 --> 07:48.400
plane policing is not.

175
07:48.400 --> 07:51.840
So that's going to timeout in a moment here. And while that's thinking about

176
07:51.840 --> 07:52.640
life and waiting to

177
07:52.640 --> 07:55.680
timeout, let's go back to R1 and let's hit the up arrow key and do a show

178
07:55.680 --> 07:56.640
policy map control

179
07:56.640 --> 08:01.790
plane again and check it out. Now it sees that there's five packets that match
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

179
07:56.640 --> 08:01.790
plane again and check it out. Now it sees that there's five packets that match

180
08:01.790 --> 08:02.720
that class map.

181
08:02.720 --> 08:06.530
And as a result, the action was dropped. And because the class map is calling

182
08:06.530 --> 08:07.280
upon the access

183
08:07.280 --> 08:11.740
control list, we did a show access list here. And if we edited this, for

184
08:11.740 --> 08:12.880
example, let's go into

185
08:12.880 --> 08:17.940
configuration mode, I'll do an IP access list extended. And let's go ahead and

186
08:17.940 --> 08:18.800
modify our access

187
08:18.800 --> 08:23.080
control list and press enter. Let's add line five. So we'll put a five there to

188
08:23.080 --> 08:24.720
put it above line 10.

189
08:24.720 --> 08:29.210
And for line number five, which will come first, if we said deny TCP coming

190
08:29.210 --> 08:31.280
from 192.168,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
08:29.210 --> 08:31.280
from 192.168,

191
08:31.280 --> 08:34.940
I should probably use the host keyword and say myself some typing, deny TCP

192
08:34.940 --> 08:37.600
coming from host 23.1.2.100,

193
08:38.160 --> 08:43.360
going to host. And let's go ahead and say it's host by five dot 25 dot 25 dot

194
08:43.360 --> 08:44.560
one and press enter.

195
08:44.560 --> 08:48.070
So now if you look at our access control, so the show access list and the name

196
08:48.070 --> 08:49.040
of our ACL,

197
08:49.040 --> 08:53.230
which I'll go ahead and copy and paste from right here, copy there, paste there

198
08:53.230 --> 08:54.000
, press enter.

199
08:54.000 --> 08:57.440
Now we have two entries. The first entry says deny so effectively because the

200
08:57.440 --> 08:58.560
class map is

201
08:58.560 --> 09:02.510
calling upon this access control list is saying deny meaning I don't care. I
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

201
08:58.560 --> 09:02.510
calling upon this access control list is saying deny meaning I don't care. I

202
09:02.510 --> 09:03.520
don't want to match

203
09:03.520 --> 09:07.490
for that stream of traffic. And then for the second entry entry 10 is still

204
09:07.490 --> 09:09.040
looking for anything else

205
09:09.040 --> 09:12.740
any TCP traffic. So effectively that means that our policy map, which is

206
09:12.740 --> 09:13.680
applied to the control

207
09:13.680 --> 09:18.710
plane is not going to care, not going to match on traffic going from our server

208
09:18.710 --> 09:19.760
to to our one

209
09:19.760 --> 09:23.750
at that address. And as a result of it not matching the control plane drop

210
09:23.750 --> 09:24.640
action is not going to

211
09:24.640 --> 09:28.120
take effect. So if we go back to the command prompt here and we hit the after a

212
09:28.120 --> 09:29.040
keyword just a moment

213
09:29.040 --> 09:32.920
to go failed, now it should succeed. So it's less against the login. So we'll
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

213
09:29.040 --> 09:32.920
to go failed, now it should succeed. So it's less against the login. So we'll

214
09:32.920 --> 09:34.240
put it on our password

215
09:34.240 --> 09:38.320
press center and we are good to go. And the value is we can do a show policy

216
09:38.320 --> 09:39.280
map control plane back

217
09:39.280 --> 09:43.250
at our one and notice there's no additional packets that have matched anybody

218
09:43.250 --> 09:44.560
do a show access list

219
09:44.560 --> 09:50.000
and press center. We now have some hits on that line five. So the deny says don

220
09:50.000 --> 09:50.800
't match or don't

221
09:50.800 --> 09:54.140
care about matching. And that's why the SSH sessions are now beginning to work.

222
09:54.140 --> 09:55.040
So with control plane

223
09:55.040 --> 09:58.700
policing, one of the features is to drop specific traffic that we're matching

224
09:58.700 --> 09:59.920
on. But another option

225
09:59.920 --> 10:03.480
is to go ahead and allow traffic up to a certain threshold and then throttle it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

225
09:59.920 --> 10:03.480
is to go ahead and allow traffic up to a certain threshold and then throttle it

226
10:03.480 --> 10:04.400
, which can also help

227
10:04.400 --> 10:07.880
protect against a denial of service attack against a router. So in the next

228
10:07.880 --> 10:08.960
video, I'd like to walk

229
10:08.960 --> 10:12.390
you through one more example of setting up control plane policing. But this

230
10:12.390 --> 10:14.080
time using a threshold

231
10:14.080 --> 10:17.410
to limit certain traffic above a certain point. So I'll see you in the next

232
10:17.410 --> 10:18.880
video in just a moment.