CoPP and management plane

Theoretical foundations and architecture

Control plane protection (Control Plane Policing, CoPP; the set of measures is described in RFC 6192) is one line of defence of a router. The CPU runs the protocols (BGP, OSPF/IS-IS, LDP, BFD) and management (SSH, SNMP). Any packet addressed to the router itself, as well as packets with TTL=1, ARP/glean and ICMP replies, goes to the CPU over a channel of limited capacity (the punt path). A flow of tens of thousands of packets per second at a loopback can delay BGP keepalives, LDP hellos and BFD packets, and the sessions will drop on timers. CoPP polices traffic toward the CPU by class (on most platforms this is done in hardware; in RouterOS the CPU itself executes comparable rules): 1. ROUTING (BGP, IGP, LDP, BFD): a generous policer, because lost hellos drop sessions. 2. MGMT (SSH, SNMP, NTP, TACACS+): only from the management network, a medium policer. 3. ICMP: a low policer, but not a full drop, otherwise PMTUD breaks. 4. DEFAULT: everything else, a minimal policer or drop. CoPP limits how much traffic reaches the CPU, but it does not replace ACLs (who may talk to the device), protocol authentication, GTSM and uRPF: the measures complement each other. A customer VRF does not protect against this threat: the PE-CE interface address is reachable by the customer.

Three planes and the punt path

Transit packets are processed in the ASIC/NPU (data plane), routing and signalling protocols live on the router CPU (control plane), and SSH, SNMP, NTP, TACACS+ and syslog belong to the management plane. Any packet addressed to the router itself (a loopback or interface address, or multicast 224.0.0.2/5/6), as well as packets with TTL=1, IP options, ARP/glean and ICMP replies, is sent to the CPU through an internal channel of limited capacity (the punt path). This channel and the processor itself are a shared resource: a stream of several tens of thousands of packets per second to a PE loopback can delay BGP keepalives, LDP hellos and BFD packets, after which sessions drop on timers and the load rolls through the network in a cascade. A customer in a VRF reaches the CPU too: the address of the PE-CE interface in its VRF answers pings and accepts TCP, so VRF isolation does not protect against this threat.

Defence in depth (RFC 6192)

RFC 6192 describes a set of independent measures: filtering at the edge (infrastructure ACLs), a receive filter on the router itself (Cisco rACL, a Junos filter on lo0), per-class rate limiting (CoPP), protocol-specific protection (authentication, GTSM, max-prefix) and monitoring. The measures complement each other: an ACL decides who may talk to the device at all, CoPP limits how much they may say, and authentication verifies that the speaker is who they claim to be. No measure replaces the others.

CoPP classes and starting policies

The numbers are deliberately omitted from the table: starting values are chosen from the platform baseline (for 1-2 weeks exceed-action transmit is set, the exceeded counters are observed, and then drop is enabled).

How to build the ACLs for the classes

Classification covers the address and port in both directions: a BGP session initiated by our side returns with segments whose source port is 179, while a session initiated by the neighbour arrives with destination port 179. ACLs that describe only one side work while the routing table does not change; after a session restart the reply packets fall into class-default and the session cannot re-establish its table. An IP ACL is useless for IS-IS: IS-IS runs at L2 (CLNP), and it is protected by separate platform means. In CoPP an IP ACL only classifies: permit means "into this class", not "allow", and deny means "into another class".

Where CoPP is applied

• Cisco IOS-XE: an MQC policy on control-plane (aggregate); there are sub-sections control-plane host for packets addressed to the device itself, control-plane transit and control-plane cef-exception. The policer is set with police cir/police rate, and counters are read in show policy-map control-plane.
• Huawei VRP: cpu-defend policy with CAR by packet type (car packet-type), whitelists and blacklists based on ACLs; the policy is applied globally or to a specific board.
• Juniper Junos: a firewall family inet filter on the input of lo0.0 (the filter applies to everything going to the RE), plus built-in DDoS protection (ddos-protection) with a policer per protocol. A lo0 filter with accept terms for the required protocols and a closing discard is the standard RE protection scheme.
• MikroTik RouterOS: the input chain of /ip/firewall/filter with address lists and limit=; there is no dedicated CoPP mechanism, and the rules run on the CPU, so they are placed in /ip/firewall/raw for an early drop.

Management plane: SSH, VTY, AAA, SNMPv3

• SSH-only: SSHv2, an RSA key of at least 2048 bits, Telnet and HTTP disabled, transport input ssh on the lines, an exec-timeout, and a limit on login attempts.
• ACL on VTY: access-class with vrf-also allows login only from the management network. It is the second line after CoPP: CoPP limits the rate, the VTY ACL limits the source.
• AAA/TACACS+: authentication, privilege-based authorization and per-command accounting on TACACS+ (RFC 8907) with a local fallback so that losing the server does not lock the engineer out of the device. The server secret is stored in encrypted form, and the console line gets its own method. RouterOS does not support TACACS+, only RADIUS.
• SNMPv3: authPriv level (SHA and AES), the user is bound to a group and a restricted view, sources are filtered by an ACL. v1/v2c communities are disabled: the string travels in clear text.

Relation to TTL, uRPF and GTSM

TTL propagation (no mpls ip propagate-ttl) hides the core from traceroute, GTSM (RFC 5082) drops BGP session packets with a TTL below the threshold, and uRPF (RFC 3704) cuts packets with a spoofed source. These mechanisms complement CoPP but are configured separately and are covered in the PE hardening lab.

How to verify

First the class counters (conformed and exceeded) and ACL hits, then load: from an untrusted source start a flood towards the loopback and make sure that exceeded grows in DEFAULT/ICMP, that BGP/LDP/BFD stay Established and that the CPU did not grow. Every ACL change is accompanied by a check that the neighbour sessions re-establish after a clear with a soft reset, and not only in the idle state.

Architecture Diagram & Topology