Cisco Nexus 3600 NX-OS, Руководство по настройке безопасности

Страница: 138 / 154

set cos 0
police cir 15 pps bc 32 packets conform transmit violate drop
class copp-system-p-class-fcoe
set cos 6
police cir 750 pps bc 128 packets conform transmit violate drop
class copp-system-p-class-l2-default
set cos 0
police cir 25 pps bc 32 packets conform transmit violate drop
class class-default
set cos 0
police cir 25 pps bc 32 packets conform transmit violate drop
Packets Per Second Credit Limit
The aggregate packets per second (PPS) for a given policy (sum of PPS of each class part of the policy) is
capped by an upper PPS Credit Limit (PCL). If an increase in PPS of a given class causes a PCL exceed, the
configuration is rejected. To increase the desired PPS, the additional PPS beyond PCL should be decreased
from other class(es).
Modular QoS Command-Line Interface
CoPP uses the Modular Quality of Service Command-Line Interface (MQC). MQC is a CLI structure that
allows you to define a traffic class, create a traffic policy (policy map), and attach the traffic policy to an
interface. The traffic policy contains the CoPP feature that will be applied to the traffic class.
Procedure
Step 1 Define a traffic class using the class-map command. A traffic class is used to classify traffic.
This example shows how to create a new class-map called copp-sample-class:
class-map type control-plane copp-sample-class
Step 2
Create a traffic policy using the policy-map command. A traffic policy (policy map) contains a traffic class
and one or more CoPP features that will be applied to the traffic class. The CoPP features in the traffic policy
determine how to treat the classified traffic.
Step 3 Attach the traffic policy (policy map) to the control plane using the
control-plane
and
service-policy
commands.
This example shows how to attach the policy map to the control plane:
control-plane
service-policy input copp-system-policy
The copp-system-policy is always configured and applied. There is no need to use this command
explicitly.
Note
CoPP and the Management Interface
The Cisco NX-OS device supports only hardware-based CoPP, which does not support the management
interface (mgmt0). The out-of-band mgmt0 interface connects directly to the CPU and does not pass through
the in-band traffic hardware where CoPP is implemented.
On the mgmt0 interface, ACLs can be configured to give or deny access to a particular type of traffic.
Cisco Nexus 3600 NX-OS Security Configuration Guide, Release 7.x
124
Configuring Control Plane Policing
Modular QoS Command-Line Interface