WEBVTT 1 00:00.000 --> 00:04.640 As another example of using control plane policing, instead of having a router 2 00:04.640 --> 00:08.130 drop traffic all the time, for example, if it's SSH or some other type of 3 00:08.130 --> 00:11.000 traffic, let's go ahead and set up a threshold. 4 00:11.000 --> 00:15.350 Now there's so many options we could do. Let's choose a fairly simple option 5 00:15.350 --> 00:17.000 and that's with ICMP. 6 00:17.000 --> 00:21.890 So to identify ICMP traffic with control plane policing, we're going to use an 7 00:21.890 --> 00:25.980 access control list and we're going to use one class map that calls upon that 8 00:25.980 --> 00:29.000 access control list, and then to specify that we want to do the throttling of 9 00:29.000 --> 00:29.000 that traffic. 10 00:29.000 --> 00:32.600 We're going to go ahead and create a policy map that specifies what we want to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:29.000 --> 00:32.600 We're going to go ahead and create a policy map that specifies what we want to 11 00:32.600 --> 00:33.000 do. 12 00:33.000 --> 00:36.490 In this case, we'll allow a certain amount of ICMP traffic and then we'll go 13 00:36.490 --> 00:40.000 ahead and throttle the rest, or meaning drop the excess of that traffic. 14 00:40.000 --> 00:43.520 And the benefit of that is, if you have a denial of service attack against the 15 00:43.520 --> 00:47.130 router, it can still process some of the ICMP if that's what we identify, but 16 00:47.130 --> 00:50.790 over a certain point, you'll start dropping it and that'll protect the control 17 00:50.790 --> 00:55.000 plane and the route processor from having to process all those packets. 18 00:55.000 --> 00:58.600 The process some, but under attack, it won't have to be overwhelmed by 19 00:58.600 --> 01:00.000 processing all of them. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 20 01:00.000 --> 01:03.530 And then third, to apply it, we'll apply that to the control plane and that'll 21 01:03.530 --> 01:05.000 be where we're applying it. 22 01:05.000 --> 01:07.000 We do that with the service policy command. 23 01:07.000 --> 01:10.540 So for the control plane, we'll go ahead and use service policy to apply the 24 01:10.540 --> 01:13.860 policy map and that policy map is calling upon the class map and that class map 25 01:13.860 --> 01:18.000 is calling upon the ACL to identify the traffic that we want to throttle. 26 01:18.000 --> 01:21.660 So with that in mind, let's go ahead and walk through an example of setting up 27 01:21.660 --> 01:24.000 ICMP throttling right here at router one. 28 01:24.000 --> 01:30.300 And also, what would be really good as a test is let's go to our three and also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 28 01:24.000 --> 01:30.300 And also, what would be really good as a test is let's go to our three and also 29 01:30.300 --> 01:35.000 our two and let's just hammer our one with a ton of ICMP traffic. 30 01:35.000 --> 01:39.610 So from our three, we'll do a pinged 10 dot 0 13 dot one and from our two, we 31 01:39.610 --> 01:42.000 'll do a pinged 10 dot 0 dot 12 dot one. 32 01:42.000 --> 01:46.490 Then we'll tell it send a thousand by payload and also repeat like a million 33 01:46.490 --> 01:50.720 times and we'll set a wait time of zero, which effectively make our routers 34 01:50.720 --> 01:54.000 like a DOS machine just going to pump out at the best of their ability. 35 01:54.000 --> 01:58.000 Thousands and thousands and thousands of those ping requests. 36 01:58.000 --> 01:59.000 I'll try to hit R one. 37 01:59.000 --> 02:02.640 In fact, our three and our two are going to be working so hard and pumping out WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 01:59.000 --> 02:02.640 In fact, our three and our two are going to be working so hard and pumping out 38 02:02.640 --> 02:06.450 all those ping requests that we may actually lose our OSPF adjacencies between 39 02:06.450 --> 02:09.000 our three and our one and our two and our one. 40 02:09.000 --> 02:12.670 But that's okay. We'll just ping the local interfaces. So we don't have to 41 02:12.670 --> 02:14.000 worry about reach ability via OSPF. 42 02:14.000 --> 02:18.000 So let's do those pings first and let's see if the impact is here on our one. 43 02:18.000 --> 02:21.040 So back in the lab environment, let's go to our one. Let's do a quick show of 44 02:21.040 --> 02:23.000 the access control list that are in place. 45 02:23.000 --> 02:27.000 And let's make another access control is just matching on ICMP traffic. 46 02:27.000 --> 02:30.000 So we'll get a configuration mode and we'll create access list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 47 02:30.000 --> 02:34.610 How about access this one on one fantastic and we'll say permit, meaning we 48 02:34.610 --> 02:38.000 want to match on ICMP traffic from anywhere to anywhere. 49 02:38.000 --> 02:41.930 Just as a simple example, then we'll create a class map. We'll call a C map 50 02:41.930 --> 02:44.000 dash ICMP press enter. 51 02:44.000 --> 02:47.840 Then we'll match on the access group and because the number of access control 52 02:47.840 --> 02:50.000 list is one zero one, we'll press enter. 53 02:50.000 --> 02:53.490 And now we have our first components regarding matching or matching with this 54 02:53.490 --> 02:57.000 class map on any ICMP traffic, which would include ping traffic. 55 02:57.000 --> 03:01.480 Oh, also, before we apply this, let's also go ahead and make sure we test our p WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 55 02:57.000 --> 03:01.480 Oh, also, before we apply this, let's also go ahead and make sure we test our p 56 03:01.480 --> 03:02.000 ings. 57 03:02.000 --> 03:06.410 So in fact, let me just pause for a moment. So here on our tool is to a ping to 58 03:06.410 --> 03:09.000 10.0.12.1. 59 03:09.000 --> 03:12.880 We'll say size is going to be a thousand and let's say the repeat is going to 60 03:12.880 --> 03:15.000 be about 10.1,2,3.1,2,3. 61 03:15.000 --> 03:20.000 That's 10 million space question mark and the timeout is going to be zero. 62 03:20.000 --> 03:22.680 And before we press enter here, I'm going to go ahead and take that same 63 03:22.680 --> 03:26.000 command and take it over to our three, paste it in. 64 03:26.000 --> 03:31.140 But I want to go ahead and ping the local interface, which is 10.0.13.1 from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 64 03:26.000 --> 03:31.140 But I want to go ahead and ping the local interface, which is 10.0.13.1 from 65 03:31.140 --> 03:32.000 the perspective of our three. 66 03:32.000 --> 03:36.170 And before we press enter, let's go take a look at how our one is doing in 67 03:36.170 --> 03:37.000 general. 68 03:37.000 --> 03:43.270 So on our one, we'll go ahead and do a show process CPU press enter and then we 69 03:43.270 --> 03:46.000 'll also, and then we'll filter a little bit more by doing a show process CPU 70 03:46.000 --> 03:46.000 pipe. 71 03:46.000 --> 03:50.000 And I only see the output where it shows CPU utilization for five seconds. 72 03:50.000 --> 03:53.000 So I'll take and include CPU and upper case press enter. 73 03:53.000 --> 03:56.370 Fantastic. So router one is pretty much sleeping right now. I'm not doing a 74 03:56.370 --> 03:57.000 whole bunch of work. 75 03:57.000 --> 04:01.210 So if we go to R2 and we launch the pings here, it's on its way and we go to R3 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 03:57.000 --> 04:01.210 So if we go to R2 and we launch the pings here, it's on its way and we go to R3 76 04:01.210 --> 04:05.000 and we launch the pings there and it's on its way and give that a moment or two 77 04:05.000 --> 04:05.000 . 78 04:05.000 --> 04:10.130 We can just go back to R1 and if we hit the upper key now, CPU utilization 79 04:10.130 --> 04:12.000 should be increasing. 80 04:12.000 --> 04:17.000 So right there it's at 14/100 and the one minute average is going up. 81 04:17.000 --> 04:20.000 And if we wait just a few more moments here, press enter. 82 04:20.000 --> 04:23.040 So I'm going to wait 60 more seconds and let's make sure the pings are still 83 04:23.040 --> 04:24.000 going and they are. 84 04:24.000 --> 04:29.000 Also, we lost our OSPF adjacency from R2 and I'm expecting this one from R3. 85 04:29.000 --> 04:32.680 And the reason for that is that R2 and R3 are so busy and staying out the pain WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 85 04:29.000 --> 04:32.680 And the reason for that is that R2 and R3 are so busy and staying out the pain 86 04:32.680 --> 04:35.000 requests that they're not able to maintain their OSPF adjacencies. 87 04:35.000 --> 04:39.460 However, if we think of a look at the show process CPU include the output with 88 04:39.460 --> 04:41.000 the line CPU and upper case, 89 04:41.000 --> 04:43.000 you notice that our CPU utilization is going up and up and up. 90 04:43.000 --> 04:46.000 So the one minute average is nine percent now. 91 04:46.000 --> 04:49.000 It was four and then six and it's just going to keep on climbing. 92 04:49.000 --> 04:53.000 And if we go back to R2 and R3, those pings are still being sent. 93 04:53.000 --> 04:56.930 So after a few more moments here on R1, if we hit the upper key and press enter 94 04:56.930 --> 05:01.000 , sure enough, we're increasing now our one minute average is ten. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 94 04:56.930 --> 05:01.000 , sure enough, we're increasing now our one minute average is ten. 95 05:01.000 --> 05:04.680 So that gives a representation of how the flooding here that we're doing with 96 05:04.680 --> 05:06.000 ICMP can impact the route processors. 97 05:06.000 --> 05:10.480 So I'll do a control shift six here on R2 and I'll also go to R3 and do a 98 05:10.480 --> 05:13.000 control shift six here to stop it. 99 05:13.000 --> 05:17.110 So now if we go back to R1 and we hit the upper key into a show process to CPU 100 05:17.110 --> 05:21.000 and press enter, it should be settling down and it is. 101 05:21.000 --> 05:24.000 So over a one minute and five minutes, those numbers will go down as well. 102 05:24.000 --> 05:27.440 So if we want to protect R1 against ICMP floods, we could go ahead and create 103 05:27.440 --> 05:29.000 control plane policing on it 104 05:29.000 --> 05:34.000 and specify a threshold for ICMP at which point if it goes over the threshold, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 104 05:29.000 --> 05:34.000 and specify a threshold for ICMP at which point if it goes over the threshold, 105 05:34.000 --> 05:37.000 it won't even bother processing the ICMP packets. 106 05:37.000 --> 05:44.000 So let's do a show access list and take a look at how far we got. So here's our 107 05:44.000 --> 05:44.000 access control list right here, 101 and we'll do a show class map. 108 05:44.000 --> 05:48.680 And we have our class map ICMP, which is matching on access 101 and our third 109 05:48.680 --> 05:51.000 step is to go ahead and create a policy map. 110 05:51.000 --> 05:54.970 So we'll go back to the configuration mode, have been policy map and let's call 111 05:54.970 --> 05:59.000 this P map dash ICMP and let's specify we're matching on the class called. 112 05:59.000 --> 06:04.340 And let's just verify what that is real quick with the do show class map. So we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 112 05:59.000 --> 06:04.340 And let's just verify what that is real quick with the do show class map. So we 113 06:04.340 --> 06:07.000 want to match on class C map dash ICMP. 114 06:07.000 --> 06:10.840 So I'll put that in space question mark, press enter and now we get to specify 115 06:10.840 --> 06:13.000 what we want to do when we see that traffic. 116 06:13.000 --> 06:17.000 So previously, we did a drop with SSH if we see a safe will drop it. 117 06:17.000 --> 06:20.540 But for this example, instead of dropping it, let's go ahead and police this 118 06:20.540 --> 06:21.000 traffic. 119 06:21.000 --> 06:24.940 So we'll type in police that traffic space question mark and we'll specify the 120 06:24.940 --> 06:29.000 target bit rate. So we're going to say 8000 space question mark. 121 06:29.000 --> 06:34.130 And if it conforms, meaning traffic is at 8000 bits per second or lower, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 121 06:29.000 --> 06:34.130 And if it conforms, meaning traffic is at 8000 bits per second or lower, we 122 06:34.130 --> 06:38.000 want the conform action to go ahead and be transmit for the exceed action. 123 06:38.000 --> 06:41.290 We can see that the seed action to any of these and for the demo, let's go 124 06:41.290 --> 06:42.000 ahead and do a drop. 125 06:42.000 --> 06:45.420 And that way the route processor never asked to even work with those packets 126 06:45.420 --> 06:49.670 that exceed that threshold space question mark and then the violate action will 127 06:49.670 --> 06:50.000 also specify as. 128 06:50.000 --> 06:54.000 Drop. So we do a do show policy map. Here's our policy map. 129 06:54.000 --> 06:59.010 We have a policy map called P map dash ICMP. It's calling upon class map ICMP, 130 06:59.010 --> 07:03.000 which is mapping over to the access control is 101. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 130 06:59.010 --> 07:03.000 which is mapping over to the access control is 101. 131 07:03.000 --> 07:07.400 And we're setting up a rate of 8000. So for the conform action, we are going to 132 07:07.400 --> 07:09.000 transmit meaning we're going to process it. 133 07:09.000 --> 07:11.830 But anything over that we're going to go ahead and drop. And then we need to 134 07:11.830 --> 07:13.000 apply this class map. 135 07:13.000 --> 07:16.570 And then to apply this, we'd go into the control plane. So we go ahead and copy 136 07:16.570 --> 07:17.000 the policy map. 137 07:17.000 --> 07:20.000 We're going to do that in just a moment. So we'll exit out. 138 07:20.000 --> 07:23.310 So let's exit all the way out of policy map configuration mode and type in 139 07:23.310 --> 07:27.850 control plane press enter the name of our service policy, which is P map dash 140 07:27.850 --> 07:29.000 ICMP space. 141 07:29.000 --> 07:33.040 Then we'll type in service policy space question mark. We want this for traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 141 07:29.000 --> 07:33.040 Then we'll type in service policy space question mark. We want this for traffic 142 07:33.040 --> 07:35.000 coming in to the router space question mark. 143 07:35.000 --> 07:39.000 So I'll put input, which means coming in and then the name of our policy map, 144 07:39.000 --> 07:42.000 which is this guy right there and press center. 145 07:42.000 --> 07:45.730 And we already have a policy map applies. Let's go ahead and remove the old one 146 07:45.730 --> 07:50.560 . So say no service policy and the name of our previous one, which is P map dash 147 07:50.560 --> 07:51.000 SSH. 148 07:51.000 --> 07:55.200 So we'll remove the previous one, which was P map dash SSH and will apply this 149 07:55.200 --> 07:57.000 to a due to a policy map again. 150 07:57.000 --> 08:00.440 And then still in control plane configuration mode, we'll type in service WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 150 07:57.000 --> 08:00.440 And then still in control plane configuration mode, we'll type in service 151 08:00.440 --> 08:04.460 policy. We'll specify our new P map for ICMP, which is right there and press 152 08:04.460 --> 08:05.000 enter. 153 08:05.000 --> 08:09.100 So now we did a show policy map. It'll show us our policy map. And if we do a 154 08:09.100 --> 08:12.580 show policy map control plane, it'll show us how it's applied to the control 155 08:12.580 --> 08:13.000 plane. 156 08:13.000 --> 08:17.740 So there's our show command right there where we're matching on C map dash ICMP 157 08:17.740 --> 08:21.000 , which is calling upon access list one zero one. 158 08:21.000 --> 08:24.880 And if we conform to eight thousand bits per second, we'll go ahead and forward 159 08:24.880 --> 08:27.000 that traffic or process that traffic. 160 08:27.000 --> 08:30.430 Anything above that, we're going to go ahead and drop. So if we do a show WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 160 08:27.000 --> 08:30.430 Anything above that, we're going to go ahead and drop. So if we do a show 161 08:30.430 --> 08:34.110 process to CPU again and just take a look at the output that has the capital 162 08:34.110 --> 08:35.000 letter CPU in it. 163 08:35.000 --> 08:39.030 Currently, it's just idling by and we go to our two and we hit the upper key to 164 08:39.030 --> 08:44.000 attack again. And our three same thing will ping with a timeout of zero. 165 08:44.000 --> 08:48.110 We'll send it a million times at our one. If we come back here, take a look. We 166 08:48.110 --> 08:51.000 do show process CPU and press enter. It's gone up a little bit. 167 08:51.000 --> 08:54.680 But at some point, it's going to start denying traffic and it won't actually 168 08:54.680 --> 08:58.000 consume all of the CPU. So if we do a show policy map control plane again, 169 08:58.000 --> 09:01.000 check it out here regarding our C map ICMP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 169 08:58.000 --> 09:01.000 check it out here regarding our C map ICMP. 170 09:01.000 --> 09:05.190 As far as conformed, we've conformed with 29 packets and the exceed and 171 09:05.190 --> 09:08.670 violated. It's been thousands and helps see that even better. Let's go back to 172 09:08.670 --> 09:09.000 our two. 173 09:09.000 --> 09:13.000 We'll do a control shift six to break that sequence. And our three will do a 174 09:13.000 --> 09:15.000 control shift six to break that sequence. 175 09:15.000 --> 09:18.780 And this time, let's do the pings again. But let's go ahead and do them a 176 09:18.780 --> 09:22.950 little bit slower. So we won't say a timeout of zero. Let's go ahead and just 177 09:22.950 --> 09:24.000 simply do no timeout. 178 09:24.000 --> 09:27.990 The default timeout will start sending those and we'll get our three same thing 179 09:27.990 --> 09:32.740 , but without the timeout of zero. So now we're just sending normal ICMP traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 179 09:27.990 --> 09:32.740 , but without the timeout of zero. So now we're just sending normal ICMP traffic 180 09:32.740 --> 09:33.000 . 181 09:33.000 --> 09:37.000 But check it out. Not all of it is making it. So here we have one that made it. 182 09:37.000 --> 09:40.640 One that made it. One that didn't and our two and a good are two same story 183 09:40.640 --> 09:41.000 there. 184 09:41.000 --> 09:44.840 And that's because on our one, it's processing some of those ICMP packets, 185 09:44.840 --> 09:48.930 those ping requests, but not others. And that's because this bad boy right here 186 09:48.930 --> 09:53.310 , this policy map applied to the control plane called PMAP dash ICMP, where if 187 09:53.310 --> 09:55.000 traffic is conforming, it's actually being processed. 188 09:55.000 --> 09:59.400 So now here for the violated packets, that number is still going up. If hit the 189 09:59.400 --> 10:02.000 up arrow key again, again, that number is still going up. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 189 09:59.400 --> 10:02.000 up arrow key again, again, that number is still going up. 190 10:02.000 --> 10:06.840 And that's why the router is not responding to all those ping requests and back 191 10:06.840 --> 10:10.000 at router one. If we did a show process CPU and press center, check it out. 192 10:10.000 --> 10:13.750 The impact is not that great on this router. That's because the control plane 193 10:13.750 --> 10:17.980 policing is stopping all that traffic before the route processor has to respond 194 10:17.980 --> 10:18.000 . 195 10:18.000 --> 10:21.500 So now that we've seen a few examples of control plane policing in the next 196 10:21.500 --> 10:23.000 video, I'd like to put you on a hands on that. 197 10:23.000 --> 10:27.070 Now, to assist you with that, I'd like to point out one resource on server one 198 10:27.070 --> 10:30.000 nug that can be very helpful as you work on this lab. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 199 10:30.000 --> 10:34.280 And that is this right here. If we minimize multi-tap putty here on the desktop 200 10:34.280 --> 10:38.000 of server one, there's a document called COPP config. 201 10:38.000 --> 10:42.130 If you double click on that, that has an example of control plane policing. And 202 10:42.130 --> 10:44.000 it really should be a C lower case, though, like that. 203 10:44.000 --> 10:47.830 In any of the case, here's an example of control plane policing. And this 204 10:47.830 --> 10:54.650 example includes matching on ICMP traffic, IPsec traffic, management traffic, 205 10:54.650 --> 10:58.140 routing traffic with OSPF, et cetera, and then having multiple class maps and 206 10:58.140 --> 11:00.000 also having multiple policy maps. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 207 11:00.000 --> 11:10.110 But included this example, there's one specifically for ICMP. So if you want to 208 11:10.110 --> 11:10.530 leverage this as an example, and you don't have to match on, for example, all 209 11:10.530 --> 11:11.000 the various types of ICMP, you can just say ICMP any, any. 210 11:11.000 --> 11:15.490 So here is the access control list that's matching on ICMP. If we get on 211 11:15.490 --> 11:19.280 further, here is the class map that's looking for that ICMP class and 212 11:19.280 --> 11:23.000 specifying policing, anything above 8000 bits per second. 213 11:23.000 --> 11:27.620 And if you scroll down, we finally have this applied to the control plane with 214 11:27.620 --> 11:31.000 service policy input and then the name of our policy map. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 214 11:27.620 --> 11:31.000 service policy input and then the name of our policy map. 215 11:31.000 --> 11:34.080 So if you want to leverage this little text document on the desktop during your 216 11:34.080 --> 11:37.130 lab as a reference, or if you want to go back to the previous videos, either 217 11:37.130 --> 11:38.000 way is absolutely great. 218 11:38.000 --> 11:41.850 So with that in mind, I'll see you in the very next video as I put you on a 219 11:41.850 --> 11:43.000 hands-on lab.