- Here we're going to take a look at troubleshooting
some elements of some control plane policing.
Control plane policing varies quite a bit
based on your iOS version, so we're going to take a look
at some general troubleshooting elements here.
If you want something more specific
to your own platform, definitely check out
the iOS documentation and configuration guide
that's made for your device.
Generally speaking, we can figure control plane policing,
we have four main steps.
We create an ACL to identify traffic,
we create class maps to define a traffic class.
We create policy maps to define a service policy,
and we apply the service policy to the control plane.
We'll walk through each of these steps together
and configure control plane policing and we'll talk about
potential troubleshooting points throughout.
Here we're connected into a very simply topology.
I have a single PC connected to a single router
and that's it.
And the way I'm going to demonstrate control plan policing,
first thing I'm going to do is I'm going to start
a continuous ping from this host PC over to my router
at 192.168.0.1.
I can use the keyword repeat followed by
a really large number, and that will essentially
give me a continuous ping, so I'll get that going,
and you can see that at the moment,
that's completely successful; we have no
control plane policing policy in place
that would be limiting ICMP traffic in any way.
Let's jump over now to our router,
so we're connected into that
and the first thing we want to do,
let's create an extended access list.
So under global configuration mode,
we can say IP access hyphen list, extended,
and we can give that a number or a name,
I'll just use 100, the first number in the range.
I'll hit enter and now you can see that
we're under access list configuration mode,
so I can add a permit statement.
So I'll say permit ICMP, any, any.
And what this is going to do,
now it might seem counterintuitive to use
the permit statement rather than a deny statement,
but what this is actually doing, remember,
we're using this ACL only to identify the traffic
for policing, rather than for filtering purposes.
We'll actually block the traffic or rate limited
or do something else with it at a later point
in the configuration.
So right now, we're only using the ACL to identify
the traffic and we do that with a permit statement.
So we have that created, we have our access control list.
Next we want to create a class map,
that's the second step.
So back under global configuration mode,
we can use the command class hyphen map.
And if we look at contextual help,
the top option we see that we can give that a name,
so I'm going to call that ping in all caps,
just very simple, very intuitive name.
Once I hit enter, we're now under class map
configuration mode.
And if we look at our contextual help yet again,
the option under there we want to use is match.
From there, once we have match, the match keyword,
if we look at our contextual help again,
the very first option there is access hyphen group.
That's exactly what we want to use.
I'm going to break out of that output
and I can say access hyphen group
and then we can call out either the name
or the number of the access control list.
Remember we already created our access control list
so we can simply point this to that
by adding the number 100, which is the access
control list we created.
I'll hint enter and that's completed.
I'm going to exit again, going back to global
configuration mode and now we can create
the policy map and give that a name.
So I'll use the command policy hyphen map
follow by the name, I'll just call that ping hyphen policy.
I'll hit enter and now we're under policy map
configuration mode.
We're going to reference the previously created
class map here.
Now if we look at contextual help under these options,
notice they're just a bit different;
there's no match statement this time.
Instead, we have the class option,
which is exactly what we want to use
followed by the name of the class map
that we just created, which was ping.
Now we can hit enter and we are under
policy map configuration mode.
Now we can define the actions that we want taken
against the identified traffic.
If we look at our contextual help,
you can see those options are quite numerous.
Lots of things you can do, you can permit,
you can drop.
I'm going to choose the keyword that we see here,
which is police.
So I'll say police and if I look at contextual help again,
you can see that we can do that in a couple of ways.
I'm going to use that very first option that we see there,
the target bit rate and that's going to allow us
to set a target bit rate in bits per second.
Notice that on the low end, the lowest value we can use
is 8000 bits per second, which is pretty low.
You probably wouldn't want to do that in production,
but in this example, I'm going to say,
8000 bits per second, and if we look at
contextual help again, the option that I'm choosing
is conform hyphen action.
And this is going to allow us to choose the action
that's taken if our traffic conforms to this rate.
Or in other words, if the rate is less than
8000 bits per second, what's going to happen?
So we have conform hyphen action,
what do we want it to do if it conforms?
So a couple of options that I want to point out,
the very top option, again, lots of options here,
but the top option, a couple of simple ones are drop.
The bottom option being transmit.
So in my case, I'm going to say that I'm going to
choose the option for transmit.
So if the traffic is conformed to the bit rate
that I've specified, if the traffic is at or lower than
8000 bits per second, it's going to allow
the traffic to pass.
Contextual help again indicates we can complete that
with the exceed hyphen action keyword.
In other words, if the rate is higher than we want
coming into the control plane.
So if it's higher than 8000 bits per second in this case,
what's going to happen?
So we can say exceed hyphen action,
look at our help commands again,
and we, again, have that same set of commands.
The top being dropped, the bottom being transmit.
So this time, I'm going to say drop.
So the entire command, what's happening here,
we're policing the traffic, ICNP traffic.
If the traffic is coming in at a rate less than
8000 bits per second, it's going to transmit.
If it exceeds that, it's going to drop it.
So that's very simply what we have here.
Now, I'll hit enter with that;
that's going to complete this part of our configuration.
The final step is the service policy,
which is going to apply everything to the
control plane interface.
So let me go back under global configuration mode,
just as we would with all the other configuration,
we want to be under global configuration mode
and if we were going to apply this to a normal interface,
we would go under the interface itself.
We would say maybe gig 0/1 if we wanted to apply that
to a physical interface.
In this case, we're applying that to our control
plane interface.
So we can use the keyword control hyphen plane,
and notice now we're under control plane configuration mode.
So this acts as a type of interface for us
when we're under that mode.
Now, if we look at our options here,
you can probably guess from the output
the option under control plan configuration
that we want is service hyphen policy.
That's going to allow us to call out our policy
that we've created.
If we look at contextual help,
we can choose the input option to apply the policy
to the input of the control plane interface.
And of course the final option is to actually
reference the policy map name that we created,
which is ping hyphen policy in my case.
I'll hit enter.
Once we do that, once we hit enter,
if we jump back over to the host PC,
you'll notice some gaps in there so we're now
experiencing drops in ICMP replies
and that's because of the policing rate limits
that we've set up.
If we go back to router one now, let's talk about
some of the areas where we would want to troubleshoot.
Now, again, there are many many ways
you can configure control plan policing.
There are lots of options so again,
we'll look at some major troubleshooting points
and commands here.
First, let's use this command show policy hyphen map.
Control hyphen plane.
And here we can see our service policy.
We see that's called a ping hyphen policy.
And we can verify that this is not only applied,
but that it's applied in the correct direction.
So we want to do that.
We can see our class map as well named ping.
And also notice we have a second class map,
the default class map down here.
So it's important to look at the order
because these are processed from the top down
just like an ACL.
So if at any point, the traffic matches any of the classes,
the processing is going to be stopped
and the actions are going to be applied from that class map.
This is important because let's say we have 10 classes
inside our policy map and a packet matches,
let's say it matches the second and the sixth class,
but only the second class action is going to be applied
because it's going to match, it's going to process,
and processing is going to stop.
So if you're expecting maybe a different action
than you're seeing, you want to check and make sure
that your class order is correct
when you're troubleshooting.
Let's also take a look at the show policy hyphen map output,
and here we can see the detailed information
about our policy map that we created.
We want to examine if we're looking here,
maybe things like the CIR, the committed information rate.
We would also want to make sure that it's been applied,
and that the rate was entered correctly.
Also check out the conform and exceed options
that we have configured.
So the conform action in this case is to transmit,
the exceed action is to drop.
Again, there are lots of other options that are possible,
so you want to make sure these match
what you're trying to do.
Also make sure that your class map that's called out here
is actually correct, that it has the correct name.
You can see that mine is ping in all caps,
and these are case sensitive.
So that's something that you want to be aware of.
If we say show class hyphen map,
we want to verify that our correct match instructions
are used.
Match any or match all.
And that they are applied.
Also, check to make sure that you've identified
the correct ACL.
You can see that I've called out ACL 100 here,
and I only have one ACL in this lab,
but if you have multiple ACL's,
that's a potential point that could get messed up.
So that's something you'll want to check.
Speaking of our ACLs, that's the final thing
to mention here.
You want to make sure that you've correctly identified
your traffic with your access control entries.
So let's say show access hyphen list,
and again, I only have a very simple ACL,
a single ACL with a single entry,
so that's very easy to troubleshoot.
But again, we want to make sure that we have
the correct ACL and we want to make sure
that we have the correct protocol called out
within the ACL.
If we're filtering by addresses or port numbers instead,
you want to double check whatever identifiers
you're using within your access control list.
So that's a look at both configuring and
troubleshooting control plane policing.