CoPP: the firewall your router's CPU deserves

Your router forwards millions of packets per second in hardware without breaking a sweat. But the packets addressed to the router itself — routing updates, SSH, SNMP, pings — all get punted to a comparatively tiny CPU. Flood that CPU and the adjacencies drop, the network unconverges, and your SSH session dies right when you need it most.

Control Plane Policing (CoPP) is exactly what it sounds like: QoS applied to the path between the forwarding hardware and the CPU.

The recipe

CoPP is built from pieces you already know — class maps, policy maps, and a service policy — just attached somewhere unusual:

ip access-list extended MGMT-TRAFFIC
 permit tcp 10.0.0.0 0.0.0.255 any eq 22
ip access-list extended ROUTING-TRAFFIC
 permit ospf any any
 permit tcp any any eq bgp
 permit tcp any eq bgp any

class-map match-any CM-MGMT
 match access-group name MGMT-TRAFFIC
class-map match-any CM-ROUTING
 match access-group name ROUTING-TRAFFIC

policy-map PM-COPP
 class CM-ROUTING
  police 512000 conform-action transmit exceed-action transmit
 class CM-MGMT
  police 256000 conform-action transmit exceed-action drop
 class class-default
  police 128000 conform-action transmit exceed-action drop

control-plane
 service-policy input PM-COPP

Note the asymmetry: routing traffic conforms and exceeds to transmit — you police it to observe it, but you never want to be the person whose CoPP policy dropped their own OSPF hellos. Management and default traffic get real limits.

Verify before you trust it

R1# show policy-map control-plane
 Control Plane

  Service-policy input: PM-COPP

    Class-map: CM-ROUTING (match-any)
      1042 packets, 81276 bytes
      police:
          rate 512000 bps, burst 16000 bytes
        conformed 1042 packets; actions: transmit
        exceeded 0 packets; actions: transmit

Watch the counters while the network is healthy so you know what normal looks like. A CoPP policy you've never read the counters of is a time bomb with your name on the change record.

Blueprint notes

• Start with class-default policing generously; tighten after observing.
• Fragments, TTL-expired packets and traffic needing ARP resolution also punt — the CPU path is busier than you think.
• On platforms with hardware CoPP, the policer runs in TCAM: zero CPU cost until packets actually exceed.

Security on the blueprint isn't just firewalls — it's making sure the boxes running your IGP stay reachable while someone floods them. CoPP is table stakes.