• After you have configured CoPP, delete anything that is not being used, such as old class maps and
unused routing protocols.
• You must ensure that the CoPP policy does not filter critical traffic such as routing protocols or interactive
access to the device. Filtering this traffic could prevent remote access to the Cisco NX-OS device and
require a console connection.
• The Cisco NX-OS software does not support egress CoPP or silent mode. CoPP is supported only on
ingress (you cannot use the
service-policy output copp
command to the control plane interface).
• You can use the access control entry (ACE) hit counters in the hardware only for ACL logic. Use the
software ACE hit counters and the
show access-lists
and
show policy-map type control-plane
commands
to evaluate CPU traffic.
• The Cisco NX-OS device hardware performs CoPP on a per-forwarding-engine basis. CoPP does not
support distributed policing. Therefore, you should choose rates so that the aggregate traffic does not
overwhelm the supervisor module.
• If multiple flows map to the same class, individual flow statistics will not be available.
• If you upgrade from a Cisco NX-OS release that supports the CoPP feature to a Cisco NX-OS release
that supports the CoPP feature with additional classes for new protocols, you must either run the setup
utility using the
setup
command or use the
copp profile
command for the new CoPP classes to be
available.
• Before you downgrade from a Cisco NX-OS release that supports the CoPP feature to an earlier Cisco
NX-OS release that supports the CoPP feature, you should verify compatibility using the
show
incompatibility nxos bootflash:filename
command. If an incompatibility exists, disable any features
that are incompatible with the downgrade image before downgrading the software.
• You cannot disable CoPP. If you attempt to disable it, packets are rate limited at 50 packets per seconds.
• Skip CoPP policy option has been removed from the Cisco NX-OS initial setup utility because using it
can impact the control plane of the network.
• Cisco Nexus 9200 Series switches support CoPP policer rates only in multiples of 10 kbps. If a rate is
configured that is not a multiple of 10 kbps, the rate is rounded down. For example, the switch will use
50 kbps if a rate of 55 kbps is configured. (The
show policy-map type control-plane
command shows
the user configured rate. See
Verifying the CoPP Configuration, on page 486
for more information.)
• For Cisco Nexus 9200 Series switches, ip icmp redirect, ipv6 icmp redirect, ip icmp unreachable, ipv6
icmp unreachable, and mtu-failure use the same TCAM entry, and they will all be classified to the class
map where the first exception is present in the policy. In the CoPP strict profile, they are classified to
the class-exception class map. In a different CoPP policy, if the first exception is in a different class map
(for example, class-exception-diag), the rest of the exceptions will be classified to the same class map.
• The copp-system-class-fcoe class is not supported for Cisco Nexus 9200 Series switches.
• The following guidelines and limitations apply to static CoPP ACLs:
• Only Cisco Nexus 9200 Series switches use static CoPP ACLs.
• Static CoPP ACLs can be remapped to a different CoPP class.
• Access control entries (ACEs) cannot be modified or removed for static CoPP ACLs.
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
471
Configuring Control Plane Policing
Guidelines and Limitations for CoPP
