WEBVTT 00:00:00.000 --> 00:00:11.760 So before we begin our discussion on control plane policing, I want to go back and revisit 00:00:11.760 --> 00:00:18.600 our discussion on device access and authentication when we were messing around with AAA authentication 00:00:18.600 --> 00:00:22.160 and AAA authorization. 00:00:22.160 --> 00:00:30.959 So let's go back to R1 on pod 3 just for a moment here. And let's hit enter to get started like we did. 00:00:30.959 --> 00:00:36.959 So we have AAA authentication set up. I configured authorization just like we did in our last session. 00:00:36.959 --> 00:00:43.160 But what we need to realize is right now the way I have it configured, if we type in Raymond, 00:00:43.160 --> 00:00:49.160 we type in our password, remember AAA server is not set up. So we are using our local user 00:00:49.160 --> 00:00:53.160 and password database as a fallback. And our problem here was that I wasn't able to get that 00:00:53.160 --> 00:01:00.160 privileged command to work. And even after research for quite a while last night, 00:01:00.160 --> 00:01:07.959 a lot of the documentation was the exact same. What I did and it still wasn't working, right? 00:01:07.959 --> 00:01:13.760 So anyways, in the end, I tested it on another device I had and what the documentation shows worked 00:01:13.760 --> 00:01:17.559 on that particular device. So basically, device specific, operating specific, 00:01:17.559 --> 00:01:22.760 and you would think that all Cisco iOS routers, same thing, same command set, same everything would work. 00:01:22.760 --> 00:01:27.959 Well, obviously, now there's a little bit extra I had to do on this device in order to get it working. 00:01:27.959 --> 00:01:34.360 So let me show you here what we have right now as our config. So show run piped section line console 0 00:01:34.360 --> 00:01:39.360 and then we will type in AAA. So that way there we can see the config that we have so far. 00:01:39.360 --> 00:01:43.760 So right now what we have is we have the authentication command here 00:01:43.760 --> 00:01:51.160 and we have the authorization command. So the authentication method list has been applied to my line, 00:01:51.160 --> 00:01:56.260 but we still have to go ahead and apply the actual authorization method list. 00:01:56.260 --> 00:02:00.360 So let's go ahead and apply that. So we'll type in line console 0 00:02:00.360 --> 00:02:06.559 and the command is authorization and then you'll see here that for exec, 00:02:06.559 --> 00:02:11.259 we will now type in the name of that method list that we actually created. 00:02:11.259 --> 00:02:17.360 So you would do that and notice it actually gives you a warning as well saying this is not going to do anything. 00:02:17.360 --> 00:02:20.960 This is useless. It doesn't even work as such. 00:02:20.960 --> 00:02:25.860 And so we'll exit out of here. I'll exit out of here. 00:02:25.860 --> 00:02:31.059 And let's go ahead and type in our username, type in our password, 00:02:31.059 --> 00:02:38.460 and you'll see I'll still be in user exec mode. I won't be elevated to privilege exec mode. 00:02:38.460 --> 00:02:44.460 So we'll type in Raymond. We'll type in our password and you'll see I'm still in user exec mode. 00:02:44.460 --> 00:02:48.160 So with that in mind, remember the command they said I need to add one more command. 00:02:48.160 --> 00:02:51.860 It's not to the line. It's the global configuration mode. 00:02:51.860 --> 00:02:58.259 So let's go ahead and add this one more command that we don't have in our configuration. 00:02:58.259 --> 00:03:02.460 And let's go ahead and right click, put that in. 00:03:02.460 --> 00:03:11.059 And now when we look at our output of do show run pipe to section line, console zero, pipe to triple A, 00:03:11.059 --> 00:03:14.360 we'll see here that now we have the authorization. 00:03:14.360 --> 00:03:18.460 We have the authentication, but we also have this authorization console as well 00:03:18.460 --> 00:03:21.259 because we're connecting through the console port in this particular case. 00:03:21.259 --> 00:03:26.759 So if we take a look at do show run pipe to section username now, 00:03:26.759 --> 00:03:30.860 what we'll see is that Raymond has privilege 15, but Conrad you don't. 00:03:30.860 --> 00:03:35.160 So Conrad, I'm going to pick on you right now. So I have privilege 15, Conrad doesn't. 00:03:35.160 --> 00:03:40.160 So let's go ahead and log in as Raymond and see if I automatically get put in privilege exec mode 00:03:40.160 --> 00:03:47.460 because it says privilege level 15. And then we'll go ahead and try Conrad's account 00:03:47.460 --> 00:03:50.960 and we'll see that Conrad, because it doesn't have privilege level 15, 00:03:50.960 --> 00:03:53.360 we're not going to be able to get in in that case. 00:03:53.360 --> 00:03:56.860 So let's put in Raymond. Let's put in Raymond's password of Cisco 00:03:56.860 --> 00:03:59.860 and you'll see that I'm automatically in privilege exec mode. 00:03:59.860 --> 00:04:03.860 All right. So let's back out of there. And now let's go ahead and try Conrad's account. 00:04:03.860 --> 00:04:08.660 We'll type in Conrad, put in Conrad's password and you'll see Conrad didn't use our exec mode. 00:04:08.660 --> 00:04:19.260 All right. So we're in. We got it. With all that pain yesterday, I figured it out. 00:04:19.260 --> 00:04:29.160 Oops. And there we go. So I had to create my method list like we did, 00:04:29.160 --> 00:04:33.859 but I also had to put this command in and make sure that we specify it right here. 00:04:33.859 --> 00:04:42.459 And it's amazing how many documents out there do not include all of that stuff. 00:04:42.459 --> 00:04:45.859 And those are Cisco articles as well. So there you go, folks. 00:04:45.859 --> 00:04:49.059 Just something to keep in mind. Probably not going to come up on the certification exam, 00:04:49.059 --> 00:04:52.459 but if it does come up on the certification exam, then yeah, 00:04:52.459 --> 00:04:55.559 it's quite possible that you might be tested on, for example, 00:04:55.559 --> 00:04:59.059 maybe applying that authorization command to the console port 00:04:59.059 --> 00:05:02.459 or even maybe that console command authorization console. 00:05:02.459 --> 00:05:05.260 So you know about it now. If it does show up, you're all prepared for it. 00:05:05.260 --> 00:05:09.359 If it doesn't show up, well, you know more than you need to know, which is not a bad thing either. 00:05:09.359 --> 00:05:13.260 All right. So let's go on to control plane policing now. 00:05:13.260 --> 00:05:16.160 And so with control plane policing, 00:05:16.160 --> 00:05:21.160 we are dealing with a service that gives us the opportunity 00:05:21.160 --> 00:05:29.459 to protect our control plane from being overwhelmed with traffic. 00:05:29.459 --> 00:05:32.660 So every single one of our Cisco devices has different planes. 00:05:32.660 --> 00:05:35.459 We have a control plane, a data plane, a security plane, a management plane, 00:05:35.459 --> 00:05:38.260 and so on and so forth. Right? So what is the data plane all about? 00:05:38.260 --> 00:05:42.260 The data plane is all about moving traffic. Moving traffic comes in on an interface 00:05:42.260 --> 00:05:45.760 and then it gets forwarded through the data plane out another interface. 00:05:45.760 --> 00:05:48.660 The goal of the data plane is not to bug the CPU. 00:05:48.660 --> 00:05:51.959 So up here we have our brains. Down here we have our power. 00:05:51.959 --> 00:05:56.559 So the idea is, is I want to move as much traffic as I possibly can 00:05:56.559 --> 00:06:01.059 without ever having to bug the control plane, without ever having to bug the CPU 00:06:01.059 --> 00:06:03.859 or using random access memory or anything like that. 00:06:03.859 --> 00:06:07.459 At the data plane, we have hardware-based tables. We have forwarding tables. 00:06:07.459 --> 00:06:10.559 We have adjacency tables. And when we say hardware-based table, 00:06:10.559 --> 00:06:14.760 we're talking about tables that are stored in ternary content addressable memory 00:06:14.859 --> 00:06:18.660 and also content addressable memory, so CAM and TCAM. 00:06:18.660 --> 00:06:24.160 And we are using application-specific integrated circuits, 00:06:24.160 --> 00:06:27.859 also known as ASICs, down at the data plane in order to make sure 00:06:27.859 --> 00:06:32.760 that we can make decisions at the data plane based on tables at the data plane 00:06:32.760 --> 00:06:34.359 without ever having to bug the control plane. 00:06:34.359 --> 00:06:38.359 So all user traffic, our goal is, hey, in and out, in and out, in and out. 00:06:38.359 --> 00:06:41.359 As you can see, data traffic comes in port 1, goes out port 2, 00:06:41.359 --> 00:06:44.660 never goes to the control plane. Never, never, never, never. Right? 00:06:44.660 --> 00:06:49.359 So how does the data plane get built? The data plane gets built based on the control plane. 00:06:49.359 --> 00:06:54.359 So the control plane uses address resolution protocol to build, what, an ARP cache. 00:06:54.359 --> 00:06:58.160 We have routing protocols, OSPF, EIGRP, BGP, ISIS, RIP, right? 00:06:58.160 --> 00:07:01.660 All of those protocols are running in the control plane, 00:07:01.660 --> 00:07:04.359 ultimately figuring out how to populate the routing table. 00:07:04.359 --> 00:07:07.260 We type in commands to do things, maybe a static route, 00:07:07.260 --> 00:07:09.559 or maybe we set a Spanish-free protocol, whatever we're doing, right? 00:07:09.559 --> 00:07:12.859 We're typing things, and everything we're doing is affecting the control plane. 00:07:12.859 --> 00:07:14.959 Once the tables are built at the control plane, 00:07:14.959 --> 00:07:18.160 then the tables that can be put into the data plane are put in there. 00:07:18.160 --> 00:07:22.559 So, for example, your routing table, your RIB, Routing Information Base, 00:07:22.559 --> 00:07:25.959 is going to ultimately become your FIB down at the data plane, 00:07:25.959 --> 00:07:28.760 using Cisco Express Forwarding on our routers. 00:07:28.760 --> 00:07:30.959 You have an ARP cache up here that's created, 00:07:30.959 --> 00:07:35.760 but down here you're going to have an adjacency table that is going to be used instead. 00:07:35.760 --> 00:07:39.359 Even your access control list, you're building your access control list here, 00:07:39.459 --> 00:07:42.859 but ultimately the data plane gets a copy of that access control list, 00:07:42.859 --> 00:07:44.859 and it's going to be stored in TCAM. 00:07:44.859 --> 00:07:48.660 Even your quality of service decisions are decided up here, 00:07:48.660 --> 00:07:50.660 but ultimately in the end stored down here. 00:07:50.660 --> 00:07:53.760 Why? So that way there we don't have to bug the CPU 00:07:53.760 --> 00:07:57.160 every time we need to make a forwarding decision for that end-user traffic. 00:07:57.160 --> 00:07:58.559 But let's think about everything else, right? 00:07:58.559 --> 00:08:01.459 Think about your ARP traffic. 00:08:01.459 --> 00:08:06.160 Think about your OSPF traffic, your EIGRP traffic, your BGP traffic. 00:08:06.160 --> 00:08:12.459 Think about pings, trace routes that are to the device or from the device, right? 00:08:12.459 --> 00:08:16.059 All of that stuff, the management traffic to or from the device, 00:08:16.059 --> 00:08:18.760 the control traffic to or from the device, 00:08:18.760 --> 00:08:23.660 that all has to be what we call punted to the control plane. 00:08:23.660 --> 00:08:29.260 Punted, that's the official term, to our control plane. 00:08:29.260 --> 00:08:31.559 Why? Because that's control type traffic. 00:08:31.559 --> 00:08:34.359 Now even management traffic has to get punted to the control plane, 00:08:34.359 --> 00:08:36.359 especially if it's management traffic for this device. 00:08:36.359 --> 00:08:38.559 Now if it's management traffic not for this device, 00:08:38.559 --> 00:08:40.359 then it doesn't get punted to the control plane. 00:08:40.359 --> 00:08:44.460 For example, if I'm a user and I'm sitting here 00:08:44.460 --> 00:08:48.059 and I ping to, let's say, the IP address of this device, 00:08:48.059 --> 00:08:51.460 well, the ping goes through the forwarding plane here, 00:08:51.460 --> 00:08:53.760 goes through the forwarding plane here, 00:08:53.760 --> 00:08:57.260 and gets punted to the control plane here because that's the destination. 00:08:57.260 --> 00:09:01.260 So through this device, that ping is just forwarded at the data plane. 00:09:01.260 --> 00:09:03.460 Here, just forwarded at the data plane. 00:09:03.460 --> 00:09:05.859 But up here, because it's destined to that device, 00:09:05.859 --> 00:09:07.859 it's got to get punted to the control plane 00:09:07.859 --> 00:09:10.960 because it's got to be processed because it's for that particular device. 00:09:10.960 --> 00:09:14.359 So even if we're running like EIGRP between these two devices, 00:09:14.359 --> 00:09:17.960 EIGRP packets, hello packet, in, out, in, out, 00:09:17.960 --> 00:09:20.059 punt to the control plane, punt to the control plane, 00:09:20.059 --> 00:09:21.760 punt to the control plane, all right? 00:09:21.760 --> 00:09:25.559 So you can see a lot of traffic can get punted to the control plane. 00:09:25.559 --> 00:09:28.159 And that means our control plane can get overwhelmed. 00:09:28.159 --> 00:09:30.960 And what happens when the control plane gets overwhelmed, 00:09:30.960 --> 00:09:32.760 then the CPU gets bogged down. 00:09:32.760 --> 00:09:36.859 If the CPU gets bogged down and memory gets overwhelmed, 00:09:36.859 --> 00:09:38.760 then what happens to your device? 00:09:38.760 --> 00:09:41.960 Your device can no longer process more control packets. 00:09:41.960 --> 00:09:44.059 It can no longer make decisions. 00:09:44.059 --> 00:09:47.960 And think about something like OSPF, our dead timer is 40 seconds. 00:09:47.960 --> 00:09:53.460 Well, what if your router CPU is maxed out 100%, let's say, for 40 seconds? 00:09:53.460 --> 00:09:56.359 Does that mean that our OSPF neighborhood is going to be broken down 00:09:56.359 --> 00:09:59.359 because no hello packets were processed in that 40 seconds? 00:09:59.359 --> 00:10:01.460 Absolutely, that's what that means. 00:10:01.460 --> 00:10:04.260 So now it's going to have a massive ripple effect throughout the environment 00:10:04.260 --> 00:10:06.059 because that neighborhood has gone down. 00:10:06.059 --> 00:10:08.760 Therefore, other routers are going to have to clear out their databases 00:10:08.760 --> 00:10:10.760 and learn new things, new type 1 LSAs. 00:10:10.760 --> 00:10:11.960 So you can see the ripple effect. 00:10:11.960 --> 00:10:14.159 If your control plane ever gets overwhelmed, 00:10:14.159 --> 00:10:18.859 there can be some serious consequences associated with that control plane 00:10:18.859 --> 00:10:21.960 not being able to do its job. 00:10:21.960 --> 00:10:24.260 Just think about you running a PC. 00:10:24.260 --> 00:10:30.659 And have you ever had your PC's CPU percentage ever go up extremely high? 00:10:30.659 --> 00:10:33.960 And then all of a sudden you hear your fans crank up to try and cool it down. 00:10:33.960 --> 00:10:36.260 But all of a sudden it's like your mouse is not really working, 00:10:36.260 --> 00:10:37.859 things are not really going well for you 00:10:37.859 --> 00:10:42.760 because your CPU is so overwhelmed it can't even process your mouse movements. 00:10:42.760 --> 00:10:47.059 Well, now imagine a router or a switch's CPU being extremely overwhelmed 00:10:47.059 --> 00:10:50.760 and not being able to do anything else that it needs to do. 00:10:50.760 --> 00:10:53.260 Luckily, maybe it can still forward the traffic. 00:10:53.260 --> 00:10:57.359 Thank goodness we have this separation here, your switches and your routers. 00:10:57.359 --> 00:11:00.460 But being able to process like spanning tree messages 00:11:00.460 --> 00:11:04.559 or any other type of requirements that it has to do, 00:11:04.559 --> 00:11:09.559 maybe like encapsulation for GRE or encapsulation for something like IPsec, 00:11:09.559 --> 00:11:12.859 now all of a sudden it can't do it, your routers, because it's overwhelmed. 00:11:12.859 --> 00:11:15.159 Now all of a sudden you've got traffic issues. 00:11:15.159 --> 00:11:17.059 So how can you get overwhelmed? 00:11:17.059 --> 00:11:19.059 Well, in many different ways. 00:11:19.059 --> 00:11:21.460 You can get overwhelmed by excessive traffic. 00:11:21.460 --> 00:11:24.059 Excessive traffic having to get punted to the CPU. 00:11:24.059 --> 00:11:27.059 It could be because of a bug, it could be because of a flaw, 00:11:27.059 --> 00:11:28.859 it could be because of a vulnerability, 00:11:28.859 --> 00:11:32.859 it could be because of a malicious event, a cyber criminal 00:11:32.859 --> 00:11:36.559 causing a denial of service attack on your device by overwhelming your CPU. 00:11:36.559 --> 00:11:40.059 So there's a lot of different reasons why that CPU can get overwhelmed. 00:11:40.059 --> 00:11:42.359 Some of them are malicious, some of them are not malicious. 00:11:42.359 --> 00:11:47.559 But the idea here is for you to take advantage of a feature called control plane policing 00:11:47.559 --> 00:11:51.960 so you can stop that control plane from being overwhelmed. 00:11:51.960 --> 00:11:55.359 So when we talk about control plane policing, think about it, it's a policer. 00:11:55.359 --> 00:11:58.159 That's what it is, a policer for the control plane. 00:11:58.159 --> 00:12:02.559 Let's police the traffic that is getting punted to the control plane. 00:12:02.559 --> 00:12:07.059 Because if I could police the traffic that's getting punted to the control plane 00:12:07.059 --> 00:12:12.760 by rate limiting that traffic, by essentially saying that, 00:12:12.760 --> 00:12:19.359 oh, this traffic is going, or there's too much of this traffic going to the control plane. 00:12:19.359 --> 00:12:21.159 Therefore, let's rate limit it. 00:12:21.159 --> 00:12:22.059 And how do you rate limit? 00:12:22.059 --> 00:12:24.760 You essentially drop some of that traffic. 00:12:24.760 --> 00:12:29.159 So if all of a sudden somebody was excessively pinging my device 00:12:29.159 --> 00:12:32.960 with massive amounts of, let's say, 1,500-byte ping packets 00:12:32.960 --> 00:12:35.260 at an exceptional rate for many different devices, 00:12:35.260 --> 00:12:40.059 and that's all getting punted to the CPU, that could ultimately overwhelm that CPU. 00:12:40.059 --> 00:12:42.760 So if all of a sudden there's an excessive number of pings, 00:12:42.760 --> 00:12:45.760 could we drop a lot of those pings 00:12:45.760 --> 00:12:50.260 and therefore in the end not overwhelm the CPU anymore? 00:12:50.260 --> 00:12:52.460 Absolutely, absolutely. 00:12:52.460 --> 00:12:56.559 So you have to think about all the different types of traffic that gets punted to the CPU 00:12:56.559 --> 00:13:00.460 and then create a policy that's going to help you rate limit that traffic, 00:13:00.460 --> 00:13:05.460 filter that traffic, so it no longer overwhelms the control plane of your device. 00:13:05.460 --> 00:13:10.159 So always remember, this is focusing on traffic that is destined to that device itself, 00:13:10.159 --> 00:13:12.359 not traffic going through the device. 00:13:12.359 --> 00:13:18.559 So if traffic's going through the device, then that means COP will not be applied. 00:13:18.559 --> 00:13:23.859 But if traffic is to the device, the CPU of the device is an example, 00:13:23.859 --> 00:13:26.359 that's when COP will get involved. 00:13:26.359 --> 00:13:30.760 And the reason why is because on our control plane right here, 00:13:30.760 --> 00:13:33.460 we actually have an interface. 00:13:33.460 --> 00:13:37.559 It's our control plane interface. It's a virtual control plane interface. 00:13:37.559 --> 00:13:44.059 So all traffic that gets punted to the CPU has to go through that control plane interface. 00:13:44.059 --> 00:13:45.260 All of it. 00:13:45.260 --> 00:13:50.960 So we're applying our COP policy to our control plane virtual interface, 00:13:50.960 --> 00:13:55.159 so that way all that traffic can then be inspected and filtered as necessary, 00:13:55.159 --> 00:13:58.359 so we don't overwhelm our CPU. 00:13:58.359 --> 00:14:03.260 Now to implement COP, we're going to use a construct called the MQC. 00:14:03.260 --> 00:14:08.659 So the MQC is the Modular Quality of Service Command Line Interface. 00:14:08.659 --> 00:14:11.960 The Modular Quality of Service Command Line Interface. 00:14:11.960 --> 00:14:14.059 So the MQC wasn't invented for COP. 00:14:14.059 --> 00:14:17.760 The MQC was invented for quality of service. 00:14:17.760 --> 00:14:20.760 And it's how we can implement quality services on a device, 00:14:20.760 --> 00:14:25.859 by specifying class maps, policy maps, and applying a service policy, 00:14:25.859 --> 00:14:27.960 all for quality of service. 00:14:27.960 --> 00:14:33.260 But it just so happens that the MQC has a feature within it called a policer. 00:14:33.260 --> 00:14:38.359 So we can take advantage of that policer aspect of the MQC, 00:14:38.359 --> 00:14:42.159 and use it for control plane policing. 00:14:42.260 --> 00:14:44.460 So we're only going to focus on the MQC here today, 00:14:44.460 --> 00:14:48.960 from the perspective of control plane policing and nothing else. 00:14:48.960 --> 00:14:51.760 So with the MQC, think of it like a route map. 00:14:51.760 --> 00:14:54.859 Whereas a route map, you're going to have different sequences, 00:14:54.859 --> 00:14:58.159 and inside those sequences, you're going to have to say what you want to match, 00:14:58.159 --> 00:15:00.460 and then what the actions you want to have for it. 00:15:00.460 --> 00:15:01.559 Sort of the same idea. 00:15:01.559 --> 00:15:03.260 Not the exact same, right? 00:15:03.260 --> 00:15:05.460 But sort of the same idea. 00:15:05.460 --> 00:15:08.559 So first of all, you're going to define a class map, 00:15:08.559 --> 00:15:11.260 which identifies traffic you want to match. 00:15:11.260 --> 00:15:12.659 But here's the thing. 00:15:12.659 --> 00:15:18.359 With control plane policing, there's really nothing built into class maps 00:15:18.359 --> 00:15:21.859 that allows you to easily identify the traffic that you want to identify 00:15:21.859 --> 00:15:23.760 for control plane policing. 00:15:23.760 --> 00:15:27.059 So we need to rely on another service outside of this. 00:15:27.059 --> 00:15:31.359 And that other service we're going to rely outside of this is access control lists. 00:15:31.359 --> 00:15:35.760 So we're going to use access control lists, just like we did for VLAN access maps, 00:15:35.760 --> 00:15:38.559 and a lot of other things like policy-based routing, 00:15:38.559 --> 00:15:41.159 to define the traffic we want to match. 00:15:41.159 --> 00:15:43.960 So typically speaking, your access control lists are all going to be 00:15:43.960 --> 00:15:45.859 permits, permits, permits, permits, permits. 00:15:45.859 --> 00:15:50.960 I want to permit this traffic, meaning I want to match this traffic. 00:15:50.960 --> 00:15:54.559 So you create your ACLs to match the traffic that you want to match 00:15:54.559 --> 00:16:00.659 for control plane policing, and then you embed the ACLs inside of the class map. 00:16:00.659 --> 00:16:06.659 So the class map has an option to match an access control list. 00:16:06.659 --> 00:16:09.559 But a lot of the other things that you can match in a class map 00:16:09.559 --> 00:16:12.859 that are built into the class map are quality of service related. 00:16:12.859 --> 00:16:16.659 So we're going to take advantage of the access control list option in that class map. 00:16:16.659 --> 00:16:20.159 So we're going to create the ACL first, embed that in the class map, 00:16:20.159 --> 00:16:23.659 and then we embed class maps inside of a policy map. 00:16:23.659 --> 00:16:27.760 So the policy map is where we define what happens to the traffic that matches. 00:16:27.760 --> 00:16:31.059 So if you match this class map, I want you to police it this way. 00:16:31.059 --> 00:16:33.760 If you match this class map, I want you to police it this way. 00:16:33.760 --> 00:16:36.559 If you match this class map, I want you to police it this way. 00:16:36.559 --> 00:16:40.559 So we're going to have one policy map with all the different class maps specified, 00:16:40.559 --> 00:16:45.659 and then define the action we want to take on that traffic inside the policy map. 00:16:45.659 --> 00:16:51.960 And then the service policy is just the application of the policy to the interface. 00:16:51.960 --> 00:16:58.559 So once you apply the policy to your interface, in this case our control plane interface, 00:16:58.559 --> 00:17:01.960 then what will happen is it becomes a service policy, 00:17:01.960 --> 00:17:04.359 and it's effected that particular point in time. 00:17:04.359 --> 00:17:10.160 So I encourage you to know these four levels for the certification exam, 00:17:10.160 --> 00:17:16.359 and know what each of them are for, meaning know the definitions like you see them here. 00:17:16.359 --> 00:17:19.660 So they say, hey, for cop, what do you use to identify your traffic? 00:17:19.660 --> 00:17:21.359 Okay, that's your class map. 00:17:21.359 --> 00:17:23.260 For cop, what do you use to define what happens? 00:17:23.260 --> 00:17:24.660 That's your policy map. 00:17:24.660 --> 00:17:27.459 For cop, what is a service policy? 00:17:27.459 --> 00:17:29.660 It's a policy map that has been applied to an interface 00:17:29.760 --> 00:17:34.359 and is now enforced and is now in effect. 00:17:34.359 --> 00:17:39.260 So I'm going to give you a really poor example here for the certification exam. 00:17:39.260 --> 00:17:44.260 Why? Because there are a billion different options, 00:17:44.260 --> 00:17:47.560 billion different configurations when it comes to control plane policing. 00:17:47.560 --> 00:17:56.560 Why? Because control plane policing is going to be something that you do based on your own circumstances, 00:17:56.660 --> 00:17:59.660 your own situations, your own scenarios. 00:17:59.660 --> 00:18:04.859 So there's no single perfect solution for everyone when it comes to control plane policing. 00:18:04.859 --> 00:18:08.560 So the things I have to point out for you for the certification exam 00:18:08.560 --> 00:18:11.959 are going to be things that are just generic in nature. 00:18:11.959 --> 00:18:16.760 So that way you have the opportunity to configure, verify, 00:18:16.760 --> 00:18:20.359 and troubleshoot control plane policing on the certification exam. 00:18:20.359 --> 00:18:23.459 So first of all, let's talk about access control lists here. 00:18:23.560 --> 00:18:26.859 Notice I have three different access control lists. 00:18:26.859 --> 00:18:28.660 You could have a hundred different access control lists. 00:18:28.660 --> 00:18:30.060 You could have one access control list. 00:18:30.060 --> 00:18:37.060 But the important thing to realize is that we're going to take the access control lists that we have, 00:18:37.060 --> 00:18:41.660 and each of these are going to be what? Part of some class map. 00:18:41.660 --> 00:18:48.359 And you have to understand how this construct works of your ACL, your class map, your policy map. 00:18:48.359 --> 00:18:57.560 Why? Because in your policy map, you define how the class map is being treated. 00:18:57.560 --> 00:19:06.160 And as a result of that, any ACLs that are in the same class map get treated the exact same way. 00:19:06.160 --> 00:19:12.560 So if I applied this, this, and this all to the same class map, 00:19:12.560 --> 00:19:21.160 then in my policy map, I'd have to treat all this traffic, and this traffic, and this traffic the exact same way. 00:19:21.160 --> 00:19:27.760 The same thing is true that if I put all three of these, if I put, sorry, 00:19:27.760 --> 00:19:31.959 if I put two of these into a class map, then once they go into a policy map, 00:19:31.959 --> 00:19:34.959 that class map, I'm going to have to treat those two the same way, 00:19:34.959 --> 00:19:37.959 but the other one can be treated differently because it's going to be part of, 00:19:37.959 --> 00:19:39.760 let's say, a different class map. 00:19:39.760 --> 00:19:44.260 So inside your policy map, you have to think, okay, in my policy map, 00:19:44.260 --> 00:19:49.859 I want to make sure that this is treated differently than this, which is treated differently than this. 00:19:49.859 --> 00:19:54.459 So if that's the case, then what do I need? I'm going to need three different class maps 00:19:54.459 --> 00:20:00.859 because each class map is then going to have a different treatment applied to it, 00:20:00.859 --> 00:20:04.660 which then means I need three different access control lists 00:20:04.660 --> 00:20:08.359 because this access control list would be part of one class map. 00:20:08.359 --> 00:20:11.060 This access control list would be part of a different class map. 00:20:11.060 --> 00:20:13.660 This access control list would be part of a different class map, 00:20:13.660 --> 00:20:17.260 and therefore now this traffic can be treated differently than this traffic, 00:20:17.260 --> 00:20:21.459 which could be treated differently than this traffic when it comes to control plane policing. 00:20:21.459 --> 00:20:26.959 So there are millions of different possible combinations you can go with, right? 00:20:26.959 --> 00:20:33.459 If you wanted to treat every single one of these entries differently, differently, 00:20:33.459 --> 00:20:36.459 every single one of these traffic types, you wanted to do differently. 00:20:36.459 --> 00:20:37.859 Well, then what does that mean for you? 00:20:37.859 --> 00:20:43.060 It means you're going to have to have a different class map for each and every single one of these. 00:20:43.060 --> 00:20:48.160 Now, in order to get a class map for each and every single one of these, 00:20:48.160 --> 00:20:51.359 it means that you're going to have to have a different access control list 00:20:51.359 --> 00:20:54.760 for each and every single one of these. 00:20:54.760 --> 00:21:00.359 So that way there, this ACL goes into a class map, which then you apply a specific policy to. 00:21:00.359 --> 00:21:02.160 Then this one goes in a different class map. 00:21:02.160 --> 00:21:05.359 So you would have to have a different ACL, not different entries, 00:21:05.359 --> 00:21:09.260 different ACLs, each with a single entry inside each and every single one of them. 00:21:09.260 --> 00:21:11.359 So you can see how flexible you can be here. 00:21:11.359 --> 00:21:16.160 You can be very granular if you want to be, or you can lump things together like we've done here. 00:21:16.160 --> 00:21:24.859 In a lot of cases, you might just group your traffic together based on the types of traffic. 00:21:24.859 --> 00:21:29.660 For example, grouping routing protocol traffic together like we've done down here, 00:21:29.660 --> 00:21:33.260 or grouping, let's say, management traffic together like we've done here, 00:21:33.260 --> 00:21:37.060 or grouping ICMP-related traffic like we have here. 00:21:37.060 --> 00:21:39.160 Maybe you'll group reporting traffic together. 00:21:39.160 --> 00:21:42.060 You'll group critical application traffic together. 00:21:42.060 --> 00:21:45.660 You'll group layer two protocol traffic together. 00:21:45.660 --> 00:21:50.959 And then maybe you'll have a grouping for everything else that you've identified that you want to block, 00:21:50.959 --> 00:21:53.859 but it doesn't fall into one of those specific categories. 00:21:53.859 --> 00:21:55.660 Or maybe something that you want to filter, right? 00:21:55.660 --> 00:21:57.959 You're going to create a different access control list for that. 00:21:57.959 --> 00:22:05.359 So you could end up with anything from one ACL to hundreds of ACLs just to accomplish your COP access control list. 00:22:05.359 --> 00:22:08.760 But the key things to realize here is, you know, we've got all permit statements 00:22:08.760 --> 00:22:14.760 because I'm not trying to control the traffic with the ACL. 00:22:14.760 --> 00:22:17.560 I'm trying to match traffic with the ACL. 00:22:17.560 --> 00:22:20.060 So permit means match this traffic. 00:22:20.060 --> 00:22:21.560 I want to match this traffic. 00:22:21.560 --> 00:22:23.359 Deny means do not match this traffic. 00:22:23.359 --> 00:22:24.160 Ignore this traffic. 00:22:24.160 --> 00:22:30.760 So if you're not on the list, I'm just going to simply ignore you and not worry about you. 00:22:30.760 --> 00:22:31.160 All right. 00:22:31.160 --> 00:22:38.160 So being able, obviously, for the exam to read an access control list entry for control plane policing is really important 00:22:38.160 --> 00:22:41.859 because if you're troubleshooting a control plane policing setup and scenario, 00:22:41.859 --> 00:22:45.560 it might be as easy as you identifying, oh, they have the wrong ACL. 00:22:45.560 --> 00:22:48.260 That's why it's not control plane policing properly. 00:22:48.260 --> 00:22:49.859 It's the wrong ACL, right? 00:22:49.859 --> 00:22:51.859 They're matching the wrong type of traffic. 00:22:51.859 --> 00:22:53.459 So since they're matching the wrong type of traffic, 00:22:53.459 --> 00:22:56.760 that means the traffic we really want to match is not actually being matched. 00:22:56.760 --> 00:23:02.459 So the answer to the control plane policing scenario on the exam might actually be fixing an ACL. 00:23:02.459 --> 00:23:07.160 So being able to read ACLs is really, really important. 00:23:07.160 --> 00:23:10.959 So then you get your class maps, and this is where we get into the MQC now, 00:23:10.959 --> 00:23:13.760 the Modular Quality of Service Command Line Interface. 00:23:13.760 --> 00:23:19.660 So with the MQC, you have, for example, your class map, your class map, and your class map. 00:23:19.660 --> 00:23:22.959 You see, these are three different class maps I've created, three different ones. 00:23:22.959 --> 00:23:27.859 Class map one, class map two, class map three. 00:23:27.859 --> 00:23:32.260 And notice that inside of each class map, I'm matching an access group. 00:23:32.260 --> 00:23:33.959 That means an access control list. 00:23:33.959 --> 00:23:37.459 That's what that means, ACL in this case. 00:23:37.459 --> 00:23:42.560 So I'm matching the access control list named COP ICMP ACL example. 00:23:42.560 --> 00:23:50.760 So that is the names that we did over here. 00:23:50.760 --> 00:23:51.959 And so I'm matching that one. 00:23:51.959 --> 00:23:54.660 And if we look down here, I'm matching the management ACL. 00:23:54.660 --> 00:23:58.959 If you look down here, I'm matching the routing protocol ACL. 00:23:58.959 --> 00:24:03.560 So for the exam, you might even have to just double check and verify, is this the right one? 00:24:03.560 --> 00:24:04.959 Is this the right one? 00:24:04.959 --> 00:24:06.660 Is this the right one? 00:24:06.660 --> 00:24:10.560 And remember that we're dealing with case-sensitive values here. 00:24:10.560 --> 00:24:20.660 So the name you put here better be the exact same name that was created here because it's case-sensitive. 00:24:20.660 --> 00:24:25.560 Now, another thing to look out for is when you create your class map, you're going to give it a name. 00:24:25.560 --> 00:24:30.359 So later on, when you embed this name in your policy map, again, 00:24:30.359 --> 00:24:34.560 you're going to have to make sure it's the right name that's embedded in the policy map on the exam. 00:24:34.560 --> 00:24:39.160 But also, this keyword here, match all, you see how it's match all? 00:24:39.260 --> 00:24:42.660 In this case, that is perfectly fine. 00:24:42.660 --> 00:24:45.260 Why do I say that is perfectly fine? 00:24:45.260 --> 00:24:53.359 I say it's perfectly fine because there is only one item in that class map, one item. 00:24:53.359 --> 00:24:55.560 And that is the access control list. 00:24:55.560 --> 00:25:01.260 So match all items in this class map, which is that single access control list. 00:25:01.260 --> 00:25:02.959 So that's perfectly fine. 00:25:02.959 --> 00:25:07.060 That is going to work exactly as we want it to. 00:25:07.060 --> 00:25:14.260 But what if, for example, you had, let's pretend here right now, folks. 00:25:14.260 --> 00:25:16.459 What if, let's erase this. 00:25:16.459 --> 00:25:20.160 Let's erase all of this. 00:25:20.160 --> 00:25:21.959 Let's erase this. 00:25:21.959 --> 00:25:24.959 Let's erase all of this. 00:25:24.959 --> 00:25:25.560 OK. 00:25:25.560 --> 00:25:27.760 So let's say that was our class map now. 00:25:27.760 --> 00:25:33.060 Class map, match all, match this access control list, this access control list, 00:25:33.060 --> 00:25:38.160 and this access control list all within the same class map. 00:25:38.160 --> 00:25:40.560 Match all, match all three. 00:25:40.560 --> 00:25:43.660 Folks, just think about what that says. 00:25:43.660 --> 00:25:45.660 It means match traffic. 00:25:45.660 --> 00:25:50.660 That is ICMP traffic, management traffic, and routing traffic. 00:25:50.660 --> 00:25:55.959 Is it possible for one packet to be all three of those at the exact same time? 00:26:04.060 --> 00:26:06.359 Absolutely not. 00:26:06.359 --> 00:26:06.959 Just think about it. 00:26:06.959 --> 00:26:14.959 Can an OSPF packet also be a SSH packet and a ping packet all at the exact same time? 00:26:14.959 --> 00:26:16.760 No, of course it can't. 00:26:16.760 --> 00:26:20.359 So you see now how this is constructed incorrectly. 00:26:20.359 --> 00:26:24.959 Because the match all keyword was used, you are telling the class map you want to match 00:26:24.959 --> 00:26:28.160 all three of these at the exact same time. 00:26:28.160 --> 00:26:31.760 So if this was the scenario, this is the wrong keyword. 00:26:31.859 --> 00:26:38.560 You would need to use the other keyword that is match any. 00:26:38.560 --> 00:26:47.060 So match any instead, you change that keyword, and now it's this or this or this. 00:26:47.060 --> 00:26:48.060 That's the difference. 00:26:48.060 --> 00:26:49.959 So pay attention to that as well. 00:26:49.959 --> 00:26:51.660 Match all versus match any. 00:26:51.660 --> 00:26:57.060 You type in match all, and if there's multiple matches, then that traffic must match all of those. 00:26:57.160 --> 00:27:01.859 If you type in match any, then it's that or that or that when it's all said and done. 00:27:05.260 --> 00:27:07.859 But now think about this scenario. 00:27:07.859 --> 00:27:13.760 If all of them, if all the three ACLs are in that class map and it says match any, does 00:27:13.760 --> 00:27:22.260 that now mean that every single one of these are going to have to be policed the exact 00:27:22.260 --> 00:27:25.260 same way now because they're in the same class map? 00:27:25.260 --> 00:27:29.959 The answer to that is yes, because once we get to our policy map and you specify the 00:27:29.959 --> 00:27:37.160 class map in that policy, then anything that matches that class map is treated the same 00:27:37.160 --> 00:27:38.160 way. 00:27:38.160 --> 00:27:44.560 So again, if that's not the result you want, then you can't do something like this. 00:27:44.560 --> 00:27:47.959 So on the exam, if they tell you you want this type of traffic to be treated one way 00:27:47.959 --> 00:27:51.660 and this type of traffic to be treated another way, just remember that would require two 00:27:51.760 --> 00:27:57.560 class maps, and then each class map would then have to have an access control list inside 00:27:57.560 --> 00:27:58.660 of each of them. 00:27:58.660 --> 00:28:04.359 So create an ACL for the two traffic types, and then that traffic gets, each ACL gets 00:28:04.359 --> 00:28:08.500 embedded in its own class map, so that way they're in the policy map, you can now treat 00:28:08.500 --> 00:28:13.160 each class map differently. 00:28:13.160 --> 00:28:20.060 I know it's a lot, I know, but you have to learn the steps, you have to learn the construct. 00:28:20.060 --> 00:28:25.459 So now if we type in show class map, you'll see that each class map has been created for 00:28:25.459 --> 00:28:31.199 us based on our configuration, but there's also one here called the default class map. 00:28:31.199 --> 00:28:35.280 So there is a class map that is automatically on your device called the default class map 00:28:35.280 --> 00:28:37.640 that catches everything else. 00:28:37.640 --> 00:28:43.199 So my ICMP traffic or my management traffic will be caught by this, my routing traffic 00:28:43.199 --> 00:28:48.000 will be caught by this based on the ACLs, and then my ICMP traffic will be caught by 00:28:48.060 --> 00:28:52.500 this, and then anything else falls into the default category. 00:28:52.500 --> 00:28:57.140 So now we'll have the opportunity to police all four of these. 00:28:57.140 --> 00:28:59.660 So now let's talk about the policy map. 00:28:59.660 --> 00:29:05.859 So the policy map, we go to global configuration, we type in policy map, and we give it a name. 00:29:05.859 --> 00:29:08.979 From there, you now start adding your class map. 00:29:08.979 --> 00:29:11.619 So here's my first class map I want to add. 00:29:11.619 --> 00:29:14.180 This is the management class map. 00:29:14.180 --> 00:29:16.339 And then now I just police it. 00:29:16.359 --> 00:29:17.959 So police it at what? 00:29:17.959 --> 00:29:19.719 A certain rate. 00:29:19.719 --> 00:29:23.839 So for example, 32,000 bits per second. 00:29:23.839 --> 00:29:25.880 So police at 32,000 bits per second. 00:29:25.880 --> 00:29:28.839 So for the exam, for example, they would tell you that number. 00:29:28.839 --> 00:29:30.520 They would tell you that number. 00:29:30.520 --> 00:29:34.079 So what is the value they want you to put there? 00:29:34.079 --> 00:29:36.359 They'd have to tell you that, right? 00:29:36.359 --> 00:29:38.380 So I put that in. 00:29:38.380 --> 00:29:42.280 And then what do you do if you are conforming to that? 00:29:42.420 --> 00:29:49.260 If that management traffic is 32,000 bits per second on average over like a five minute 00:29:49.260 --> 00:29:53.660 period or less. 00:29:53.660 --> 00:30:03.540 So if it's 32,000 bits per second or less on average, then we can punt it to the CPU. 00:30:03.540 --> 00:30:08.619 But if we're exceeding that and traffic arrives, so if we're exceeding that at that moment, 00:30:08.619 --> 00:30:11.680 let's say we're at 33,000 bits per second. 00:30:11.680 --> 00:30:16.880 We're exceeding that value, then we're going to start dropping some of those packets to 00:30:16.880 --> 00:30:20.760 get ourselves back down to 32,000 bits per second or less. 00:30:20.760 --> 00:30:31.959 That's what that means. 00:30:31.959 --> 00:30:37.079 There is another option here that you might see, and it's violate. 00:30:37.079 --> 00:30:41.979 So if you see violate, it simply allows you to have three different actions. 00:30:41.979 --> 00:30:42.979 So what does that mean? 00:30:42.979 --> 00:30:46.140 Typically, if you violate, then you're going to be dropped. 00:30:46.140 --> 00:30:52.300 And then exceed action, you could actually have a different option there. 00:30:52.300 --> 00:30:58.459 So for example, traffic that exceeds that limit, you could turn around and you could 00:30:58.459 --> 00:31:01.420 maybe mark it as being exceeded. 00:31:01.420 --> 00:31:03.380 So you can take other actions like marking the traffic. 00:31:03.380 --> 00:31:05.819 So that way there, you still allow it to go. 00:31:05.819 --> 00:31:10.079 But if we continue to have issues, then we'll go into the violation mode to kind of give 00:31:10.079 --> 00:31:13.880 it a little extra time if you wanted to. 00:31:13.880 --> 00:31:16.119 So it's just a couple of different options. 00:31:16.119 --> 00:31:20.599 So whether you see conform action, transmit, exceed action, drop, or conform action, transmit, 00:31:20.599 --> 00:31:23.900 or violate action, drop, so you don't even have to have this one here. 00:31:23.900 --> 00:31:29.579 Or you might see conform action, transmit, exceed action, transmit, violate action, drop. 00:31:29.579 --> 00:31:32.640 Those could be options as well for you on the exam. 00:31:32.640 --> 00:31:34.599 Just don't let that throw you off the wording. 00:31:34.599 --> 00:31:36.900 There's three possible values that you could have. 00:31:36.900 --> 00:31:39.420 And whatever you see, just look at what's going on. 00:31:39.420 --> 00:31:43.579 Conforming, I'm transmitting, if I'm exceeding, I'm dropping, if I'm violating, dropping, 00:31:43.579 --> 00:31:44.579 whatever it is. 00:31:44.579 --> 00:31:46.859 The words tell you exactly what's going on. 00:31:46.859 --> 00:31:47.859 Right. 00:31:47.859 --> 00:31:52.699 And then if you look at our next class map, I'm embedding the next class map in my policy 00:31:52.699 --> 00:31:53.699 map. 00:31:53.699 --> 00:31:55.699 And this one is for the routing protocols. 00:31:55.699 --> 00:31:59.939 I just put in a police here of 34,000 bits per second, conform action, transmit, exceed 00:31:59.939 --> 00:32:01.780 action, drop as an example. 00:32:01.780 --> 00:32:02.780 So again, reading it. 00:32:02.780 --> 00:32:03.780 Can you read it top down? 00:32:03.959 --> 00:32:04.959 And this is important. 00:32:04.959 --> 00:32:06.640 This is top-down processing as well. 00:32:06.640 --> 00:32:11.239 So when traffic arrives, it's going to be compared to this first. 00:32:11.239 --> 00:32:12.239 Is it management traffic? 00:32:12.239 --> 00:32:13.239 Oh, no, it's not. 00:32:13.239 --> 00:32:14.239 Okay. 00:32:14.239 --> 00:32:15.239 Go to the next one. 00:32:15.239 --> 00:32:16.239 Is it routing traffic? 00:32:16.239 --> 00:32:17.239 Yes, it is. 00:32:17.239 --> 00:32:18.239 Okay. 00:32:18.239 --> 00:32:19.239 This applies now. 00:32:19.239 --> 00:32:20.239 Right. 00:32:20.239 --> 00:32:21.239 Traffic comes in. 00:32:21.239 --> 00:32:22.239 It's SSH traffic. 00:32:22.239 --> 00:32:24.239 Oh, that's management traffic. 00:32:24.239 --> 00:32:25.239 Okay. 00:32:25.239 --> 00:32:26.239 So this one applies. 00:32:26.239 --> 00:32:32.040 So top-down processing, immediate execution upon a match, and then you got your default 00:32:32.300 --> 00:32:36.219 class at the very bottom, which is not shown here, because I'm just going to leave it as 00:32:36.219 --> 00:32:37.979 its default values in this example. 00:32:37.979 --> 00:32:38.979 That's why we don't see it. 00:32:38.979 --> 00:32:41.140 But we'll see it in our policy map once it's applied. 00:32:41.140 --> 00:32:42.500 I'll show it to you when we get there. 00:32:42.500 --> 00:32:43.500 All right. 00:32:43.500 --> 00:32:50.339 Now, this one here, I purposely set to very low value so I can do a demonstration. 00:32:50.339 --> 00:32:54.579 And so this particular very low value says police at 8,000 bits per second. 00:32:54.579 --> 00:32:56.060 And if we conform to that, we transmit. 00:32:56.060 --> 00:32:57.380 If we exceed, we drop. 00:32:57.380 --> 00:32:58.380 All right. 00:32:58.380 --> 00:33:00.660 So that's all we're doing here with control plane policing. 00:33:00.959 --> 00:33:04.560 Obviously, the MQC, when using it for quality of service, has a lot more options that come 00:33:04.560 --> 00:33:05.560 into play. 00:33:05.560 --> 00:33:09.640 But this is just the basics for control plane policing, and it's what you need to know for 00:33:09.640 --> 00:33:10.640 the certification exam. 00:33:10.640 --> 00:33:11.640 All right. 00:33:11.640 --> 00:33:18.319 So now that we have our policy map created, then we can verify by typing in show policy 00:33:18.319 --> 00:33:19.319 map. 00:33:19.319 --> 00:33:22.119 So, for example, like being able to read this on the certification exam is important. 00:33:22.119 --> 00:33:26.359 So the things to look out for is the committed information rate, 32,000 bits per second, 00:33:26.660 --> 00:33:27.660 34,000. 00:33:27.660 --> 00:33:31.500 Make sure those are the values that they actually specified for the certification exam. 00:33:31.500 --> 00:33:37.219 And then make sure something like this, this, this, oops, this, this, this, and this are 00:33:37.219 --> 00:33:39.540 exactly what they are specifying in those cases. 00:33:39.540 --> 00:33:42.859 Those are the key values to know for the certification exam. 00:33:42.859 --> 00:33:44.380 And make sure, is that the right class map? 00:33:44.380 --> 00:33:45.699 Is that the right access control list? 00:33:45.699 --> 00:33:48.619 That's what you're trying to verify in all those different scenarios. 00:33:48.619 --> 00:33:52.380 And then we apply to the interface by going to the control plane interface. 00:33:52.380 --> 00:33:56.439 So I told you it was an interface, it's having control plane, and now you're in the control 00:33:56.439 --> 00:33:58.520 plane configuration mode. 00:33:58.520 --> 00:34:04.560 And it says here, service policy input COF policy map examples, so putting the name of 00:34:04.560 --> 00:34:07.119 the control plane policy in place. 00:34:07.119 --> 00:34:11.919 Most Cisco devices only support input, meaning only if it's being punted, but you can actually 00:34:11.919 --> 00:34:17.360 set up a COF policy for outbound traffic as well on a multitude of different devices. 00:34:17.360 --> 00:34:22.699 So that's why input exists, because on some devices it's input, output. 00:34:22.699 --> 00:34:27.419 So you can control a plane in or out of the control plane, or just so you can police in 00:34:27.419 --> 00:34:28.419 or out of the control plane. 00:34:28.419 --> 00:34:32.600 All right, so now the feature has been enabled in the control plane, great. 00:34:32.600 --> 00:34:37.219 So if we type in show policy map interface brief, what will we see in this example? 00:34:37.219 --> 00:34:41.459 COF policy map example, control plane. 00:34:41.459 --> 00:34:49.239 So we know it's applied to the control plane interface. 00:34:49.239 --> 00:35:01.520 All right, so let's look at our actual policy now in action, and I'll walk you through it. 00:35:01.520 --> 00:35:06.739 So being able to read this on the exam is important, so come back and read this. 00:35:07.320 --> 00:35:12.399 What I explain to you and show you to read in here is what you want to know. 00:35:12.399 --> 00:35:17.219 Everything else would be noise on the certification exam. 00:35:17.219 --> 00:35:20.879 Everything else would be noise as you prepare for the exam, so stay as focused as you can 00:35:20.879 --> 00:35:22.679 with this. 00:35:22.679 --> 00:35:26.040 And try not to get yourself too far in the weeds, because if you do, then you are going 00:35:26.040 --> 00:35:29.280 to be spending a lot of time learning things you don't need to know for the exam, and that 00:35:29.280 --> 00:35:33.239 is time you need to be learning a lot of other things to get ready for the exam. 00:35:33.239 --> 00:35:38.080 So show policy map control plane, it's applied to the control plane. 00:35:38.080 --> 00:35:44.300 This is the service policy that has been applied, meaning that you will want to double check, 00:35:44.300 --> 00:35:48.620 is that actually the right policy map that was created? 00:35:48.620 --> 00:35:54.939 Now down here, you can see the policy map is kind of laid out for you, exactly how you 00:35:54.939 --> 00:35:58.179 created it, which is nice, but you also have your statistics in here. 00:35:58.179 --> 00:36:00.699 That's why we're looking at it this way. 00:36:00.699 --> 00:36:05.840 Because if we just typed in show policy map example, then what we'd be seeing, we'd be 00:36:05.840 --> 00:36:09.280 seeing the policy map without the statistics. 00:36:09.280 --> 00:36:16.479 So here's our class map that we created, and notice how it even says match all, so be mindful 00:36:16.479 --> 00:36:17.479 with that as well. 00:36:17.479 --> 00:36:21.399 If you're on the exam, and you're looking at the class map, and the scenario says this 00:36:21.399 --> 00:36:26.439 is not working, that's not working, this traffic type is not being matched appropriately, or 00:36:26.439 --> 00:36:30.580 it's not being controlled like you want it to, well, maybe it's because that's match 00:36:30.580 --> 00:36:36.260 all instead of match any, so therefore the traffic's not being caught by that particular 00:36:36.260 --> 00:36:39.860 class map that's specified in the policy map, and that goes back to what we talked about 00:36:39.860 --> 00:36:40.860 a while ago. 00:36:40.860 --> 00:36:44.939 So if you had match all, and you had four different access control lists inside of that 00:36:44.939 --> 00:36:52.060 class map, and you had match all, well, the odds of any traffic matching that now is zero, 00:36:52.060 --> 00:36:58.179 because there's no way your traffic could be all those different types of things. 00:36:58.179 --> 00:37:04.439 They can't be a routing protocol, and a management protocol, and an ICMP packet, or anything 00:37:04.439 --> 00:37:06.639 else all at the exact same time. 00:37:06.639 --> 00:37:11.159 So be mindful, it could be something as simple as looking at this going, hmm, let's go double 00:37:11.159 --> 00:37:14.840 check the class map and see what ACLs are inside of it. 00:37:14.840 --> 00:37:19.760 Oh, look at that, there's three ACLs, that should be match any, not match all in that 00:37:19.760 --> 00:37:21.040 particular case. 00:37:21.040 --> 00:37:24.820 So then you look at the answer options, let's say it's a multiple choice question, multiple 00:37:24.820 --> 00:37:28.659 choice question says change the class map caught, management traffic class map example 00:37:28.659 --> 00:37:29.659 to match any. 00:37:29.659 --> 00:37:30.659 There you go, you're done. 00:37:30.659 --> 00:37:34.620 Right, it could be something as simple as that, but you gotta be aware of how the construct 00:37:34.620 --> 00:37:40.179 works in order to figure that out. 00:37:40.179 --> 00:37:47.820 You'll see here now that 120 packets so far have been punted to the CPU in this particular 00:37:47.820 --> 00:37:52.760 case, or have been, I should say, seen in this particular case, doesn't mean they were 00:37:52.760 --> 00:37:59.879 punted to the CPU, it means they have been seen right now by this particular class map 00:37:59.879 --> 00:38:06.560 in this policy map, and they total approximately 6,662 bytes. 00:38:06.560 --> 00:38:12.199 You'll see here that our five minute rate right now is 1,000 bits per second, and right 00:38:12.199 --> 00:38:16.600 now our drop rate is zero, meaning we're not dropping anything. 00:38:16.600 --> 00:38:23.979 You'll see that we're matching this particular access control list, so if the class map had 00:38:23.979 --> 00:38:27.340 more than one access control list, they would all be listed here, so technically speaking 00:38:27.340 --> 00:38:33.120 you do not have to leave here to see if that is correct or not, because just by looking 00:38:33.120 --> 00:38:38.379 down here, if there was more than one access control list specified, and one was management, 00:38:38.379 --> 00:38:45.320 let's say one was routing protocols, one was ICMP, well then you know that would be incorrect. 00:38:45.320 --> 00:38:50.139 So you can go look at other values to confirm, and then answer your questions as needed. 00:38:50.139 --> 00:38:53.520 But you'll see here, let's go back to our rate, five minute offer rate is 1,000, what 00:38:53.520 --> 00:38:59.479 is our policing rate, it's 32,000 bits per second folks, that's what it is. 00:38:59.479 --> 00:39:03.600 So we are well under 32,000 bits per second, what does that mean? 00:39:03.600 --> 00:39:20.000 That means that all 120 packets so far have conformed, they have conformed. 00:39:20.000 --> 00:39:26.419 And therefore, we transmitted them, whereas if we had exceeded, we would drop, but zero 00:39:26.419 --> 00:39:27.560 packets have been exceeded. 00:39:27.560 --> 00:39:30.919 Yeah, so your five minute offered rate is 1,000 bits per second, that is our average 00:39:30.919 --> 00:39:43.719 over five minutes right now, that is our average over our five minute period. 00:39:43.719 --> 00:39:45.280 Now look at our next one. 00:39:45.280 --> 00:39:49.800 So when we read this for our next one, there's our class map, same thing to confirm this, 00:39:49.800 --> 00:39:55.120 confirm all of this, you'll see 94 packets in total have been seen by this class map 00:39:55.120 --> 00:39:58.800 and our policy map, totaling about 9,000 bytes. 00:39:58.800 --> 00:40:03.600 Look at our five minute offered rate right now, there's like nothing, there is nothing. 00:40:03.600 --> 00:40:08.280 There is not enough routing protocol traffic right now, because I think I was either running 00:40:08.280 --> 00:40:12.879 EIGRP or OSPF, I can't remember when I did this example, that was all I was running. 00:40:12.879 --> 00:40:19.280 So if it was EIGRP, there'd be an EIGRP packet once every five seconds. 00:40:19.280 --> 00:40:21.899 And for OSPF, there'd be one every 10 seconds. 00:40:21.899 --> 00:40:25.040 So in the end, over a five minute period, it's like nothing. 00:40:25.040 --> 00:40:26.840 It's nothing as you can see. 00:40:26.879 --> 00:40:31.479 And right now I have the policer set to 34,000 bits per second, so obviously we're not even 00:40:31.479 --> 00:40:34.520 close to achieving that. 00:40:34.520 --> 00:40:37.320 So there's all 94 packets being sent. 00:40:37.320 --> 00:40:41.479 So what you want to realize for the real world, and like I said, there's no perfect answer 00:40:41.479 --> 00:40:47.320 for this, is you would have to figure out what is the value that you would have here 00:40:47.320 --> 00:40:48.840 in the real world. 00:40:48.840 --> 00:40:51.399 What is your policer going to be set to? 00:40:51.399 --> 00:40:56.919 What is the committed information rate you are going to have based on that policer? 00:40:56.919 --> 00:41:02.360 And you are going to have to identify that by monitoring your traffic, by identifying 00:41:02.360 --> 00:41:07.719 those traffic types and understanding what is the threshold you want to have for that 00:41:07.719 --> 00:41:14.000 traffic, and if that is ever breached, then your policer is going to rate limit that traffic. 00:41:14.000 --> 00:41:17.600 But if it's under that value, it's going to be perfectly fine. 00:41:17.600 --> 00:41:19.199 So that's something you've got to figure out. 00:41:19.199 --> 00:41:21.320 I don't have a perfect answer for you. 00:41:21.320 --> 00:41:27.360 It takes time, it takes energy, and when you do control plane policing, it's something 00:41:27.360 --> 00:41:31.840 you build and then you constantly tweak and tweak and tweak and tweak and tweak and tweak 00:41:31.840 --> 00:41:33.600 and tweak and tweak and tweak. 00:41:33.600 --> 00:41:39.639 For example, you might build something that is very simple, something that catches, for 00:41:39.639 --> 00:41:45.439 example, specific types of traffic, but the access control list is very generic. 00:41:45.439 --> 00:41:51.280 So it's not from a specific source or destination, the ACL, maybe it's just capture all IC and 00:41:51.280 --> 00:41:54.600 P traffic from any source to any destination, right? 00:41:54.600 --> 00:41:55.600 That's it. 00:41:55.600 --> 00:42:00.040 And then over time, you monitor that, and then you might start identifying very specific 00:42:00.040 --> 00:42:07.040 types of traffic, and maybe some of those very specific types of traffic are causing 00:42:07.040 --> 00:42:08.520 you issues. 00:42:08.520 --> 00:42:12.959 And then as a result of that, you might want to create an access control list that is very 00:42:12.959 --> 00:42:18.639 specific to that traffic, and then create a class map, very specific to that traffic, 00:42:18.639 --> 00:42:25.520 and then add an entry to your policy map earlier on, earlier on, because it's very, 00:42:25.520 --> 00:42:29.280 the more granular, the earlier you want to put it, just like an ACL, typically, the more 00:42:29.280 --> 00:42:31.919 granular it is, put it higher in the ACL list. 00:42:31.919 --> 00:42:37.439 So put it nearer the top that class map, and then you're going to be able to catch that 00:42:37.439 --> 00:42:42.479 granular traffic, whatever it happens to be, and drop it maybe, maybe you want to drop 00:42:42.479 --> 00:42:43.479 it all. 00:42:43.479 --> 00:42:46.560 Maybe you're like, hey, we don't even need this traffic type, but I keep getting messages 00:42:46.560 --> 00:42:49.280 about it, and I don't even need it. 00:42:49.280 --> 00:42:51.000 Okay, well, why is that happening? 00:42:51.000 --> 00:42:55.760 It could be because some other service or feature or thing that's running in the environment 00:42:55.760 --> 00:42:59.760 that your router gets a copy of like a broadcast message and punts it to the CPU. 00:42:59.760 --> 00:43:04.760 It's like, well, geez, that's just causing undue stress on my router for no reason. 00:43:04.760 --> 00:43:08.199 So let's drop that traffic if the router ever receives it. 00:43:08.199 --> 00:43:10.239 So something as simple as that, right? 00:43:10.239 --> 00:43:14.439 You could just totally say, I don't even want it punted to the CPU, just say, if the traffic 00:43:14.439 --> 00:43:19.080 matches this ACL, drop, period, done. 00:43:19.080 --> 00:43:35.879 Could be as simple as that. 00:43:35.879 --> 00:43:40.399 So is there a way to send a message when the CPU goes bald on a certain threshold? 00:43:40.399 --> 00:43:45.639 So for example, using SNMP for that would be a good option. 00:43:45.639 --> 00:43:50.000 Using simple network management protocol to monitor CPU utilization, and if it goes beyond 00:43:50.000 --> 00:43:55.879 a certain threshold, then you could be notified via SNMP about that, and then you could jump 00:43:55.879 --> 00:44:00.120 in and figure out why that is, and once you figure out why it's gone, then you might want 00:44:00.120 --> 00:44:02.719 to set up a cop policy to police that. 00:44:02.719 --> 00:44:10.199 All right, let's move on down here now, because my final example in this particular 00:44:10.199 --> 00:44:17.120 case is going to be one where we actually exceed and we actually drop. 00:44:17.120 --> 00:44:19.979 So if you recall, this is about ICMP traffic. 00:44:19.979 --> 00:44:26.000 So in this scenario, what I did is I had my cop policy set up on my router, and then I 00:44:26.000 --> 00:44:32.620 went to all my other routers, all my other devices, and I sent 1,500 byte pings nonstop 00:44:32.620 --> 00:44:34.159 to this device. 00:44:34.159 --> 00:44:35.639 That's what I did. 00:44:35.639 --> 00:44:47.520 And so as you can see, we had 200 packets, and it is showing up as 196,412 bytes, and 00:44:47.520 --> 00:44:49.560 I wasn't even running this for five minutes. 00:44:49.560 --> 00:44:50.560 So let's be clear. 00:44:50.560 --> 00:44:57.040 This five-minute offered rate is like a calculation that the device does, approximation. 00:44:57.040 --> 00:45:01.239 So I had only been running this for like a very small amount of time, because 200 packets 00:45:01.239 --> 00:45:08.600 with all the devices that were pinging, that would have happened within a matter of less 00:45:08.600 --> 00:45:10.760 than 30 seconds, as an example. 00:45:10.760 --> 00:45:14.239 But by doing its calculations, it was able to figure out, wait a second, this five-minute 00:45:14.239 --> 00:45:19.280 offered rate is going to be approximately 7,000 bits per second, or more than that, 00:45:19.280 --> 00:45:20.280 pardon me. 00:45:20.280 --> 00:45:23.560 It's going to be more than that, because if you look at the combined here, 7,000 plus 00:45:23.560 --> 00:45:24.560 4,000. 00:45:24.560 --> 00:45:25.560 7,000 plus 4,000. 00:45:25.560 --> 00:45:28.760 Really, I've got 11,000. 00:45:28.760 --> 00:45:31.600 So I'm going to approximate 7,000 here. 00:45:31.600 --> 00:45:35.320 We got 4,000 as our drop rate, when it's all said and done. 00:45:35.320 --> 00:45:39.699 So again, average over five minutes, whether it's been five minutes or not. 00:45:39.699 --> 00:45:41.560 And so now we've got to be proactive here. 00:45:41.560 --> 00:45:42.800 We've got to start dropping stuff. 00:45:42.800 --> 00:45:48.300 So our committed information rate is 8,000, so we've got to be below 8,000. 00:45:48.300 --> 00:45:50.580 So that's what it's done here. 00:45:51.500 --> 00:46:00.560 You'll see that we've transmitted 103 packets successfully, but we've dropped 97 packets. 00:46:00.560 --> 00:46:06.540 So that way there, we can make sure that we don't exceed the 8,000 bits per second. 00:46:06.540 --> 00:46:10.659 So we had to drop 97 packets to keep ourselves under 8,000 bits per second. 00:46:10.659 --> 00:46:12.979 So that's just an example, right? 00:46:12.979 --> 00:46:16.060 So that's so you have the ability to read these on the exam. 00:46:16.060 --> 00:46:18.179 They could give you any type of scenario. 00:46:18.179 --> 00:46:19.179 It could be a silly scenario. 00:46:19.179 --> 00:46:23.540 It could be a scenario that doesn't even make sense from a traffic standpoint. 00:46:23.540 --> 00:46:25.500 But the idea here is, hey, they have a question. 00:46:25.500 --> 00:46:26.500 They have a scenario. 00:46:26.500 --> 00:46:27.939 They're asking you something specific. 00:46:27.939 --> 00:46:30.780 Can you read through this and identify what it is? 00:46:30.780 --> 00:46:37.939 It could be something as something as out of the following options, which are true. 00:46:37.939 --> 00:46:42.979 So now you have to read all your options and you have to compare the options to what you 00:46:42.979 --> 00:46:45.860 see. 00:46:45.860 --> 00:46:50.419 And then whichever ones are true, those are your answers. 00:46:50.419 --> 00:46:52.820 Whichever ones are false, those are not your answers. 00:46:52.820 --> 00:46:54.699 So it could be a multiple choice, multiple answer question. 00:46:54.699 --> 00:46:57.219 It could be a multiple choice, single answer question. 00:46:57.219 --> 00:47:03.860 They'll let you know in those cases. 00:47:03.860 --> 00:47:07.300 But the idea is to make sure, yeah, you can read through this and you understand what 00:47:07.300 --> 00:47:10.639 you're looking at based on what I've shown you. 00:47:10.639 --> 00:47:12.899 And the rest of the stuff would just be in the weeds. 00:47:12.899 --> 00:47:16.939 It would be noise that'll distract you on the exam. 00:47:16.939 --> 00:47:20.459 So your goal here is to be as focused as you possibly can with COP because there's so much 00:47:20.459 --> 00:47:21.620 more to learn. 00:47:21.620 --> 00:47:25.100 We could spend an entire session on control plane policing, get into the nitty gritty 00:47:25.100 --> 00:47:29.419 details, a bunch of different things, but it's not going to benefit you for the certification 00:47:29.419 --> 00:47:30.419 exam. 00:47:30.419 --> 00:47:34.060 If you want to learn more about COP and the nitty gritty details for your real world, 00:47:34.060 --> 00:47:39.659 then I suggest you look into the COP documentation that Cisco offers for the specific router 00:47:39.659 --> 00:47:44.139 platforms that you have running the specific iOS version you have so that you can get the 00:47:44.139 --> 00:47:52.580 nitty gritty details you need for that very specific scenario and circumstance you need. 00:47:52.580 --> 00:47:58.580 So that is control plane policing to get you ready for the certification exam.