Hi, we recently installed CoPP on several boxes (Sup720, Sup2T). We have a lot of "allow ..." whitelist rules and end with a class dropping everything:
class class-copp-any-ip police cir 128000 bc 1000 conform-action drop exceed-action drop violate-action drop class-map match-any class-copp-any-ip match access-group name acl-copp-any-ip ip access-list extended acl-copp-any-ip permit ip any any This works fine so far but we now found out that this results in a certain problem: Host A with IP x.x.x.x is connected to the Cisco and has no ARP entry yet. If somebody from outside starts a connection to host A (TCP/UDP), the packet is dropped, the Cisco does not learn the MAC of host A. I guess this happens because without an existing arp entry the packet needs to be sent to the RP and is dropped by CoPP. I changed the last rule to "conform-action transmit" to allow a small amount of any traffic. This works but is not what we intented. Is there a way to match that "destination IP = connected IP without entry in arp table" traffic ? I found no such option in the syntax. Any other option, maybe bypass CoPP for that traffic and rate-limit it another way ? kind regards Rolf _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
