ExamFinch.com My Study

Study guide

16.3 Control Plane Policing (CoPP) & Control Plane Protection (CPPr)

Practice this exam

CCNP Enterprise ENCOR 350-401

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Enterprise Architecture & Hierarchical Design

1.1 Enterprise Network Design Models & Hierarchical Campus Architecture 1.2 On-Premises, Cloud & Hybrid Infrastructure Deployment Models 1.3 Hardware Switching Architecture & Packet Forwarding

2 Chapter 2: Enterprise Quality of Service (QoS)

2.1 QoS Components: Classification, Marking & Trust Boundaries 2.2 QoS Policy: Queuing, Shaping, Policing & Interpreting MQC Output

3 Chapter 3: Software-Defined WAN (Catalyst SD-WAN)

3.1 Cisco Catalyst SD-WAN Architecture & Orchestration 3.2 SD-WAN Policies, Traffic Engineering & Application-Aware Routing

4 Chapter 4: Software-Defined Access (Catalyst SD-Access)

4.1 Catalyst SD-Access Fabric Architecture & Plane Separation 4.2 Cisco TrustSec, Security Group Tags (SGT), SXP & MACsec

5 Chapter 5: Device & Data Path Virtualization

5.1 Server & Network Device Virtualization 5.2 VRF-Lite & Virtual Routing Multi-Tenancy 5.3 GRE & IPsec Tunnel Virtualization Mechanics

6 Chapter 6: Network Virtualization & Overlay Technologies

6.1 LISP Architecture & EID-to-RLOC Mapping Mechanics 6.2 VXLAN & EVPN Overlay Architecture

7 Chapter 7: Layer 2 Infrastructure & Switching

7.1 VLANs, 802.1Q Trunking & VTPv3 7.2 Spanning Tree Protocol Mechanics 7.3 Advanced STP Protection Mechanisms 7.4 EtherChannel Link Aggregation

8 Chapter 8: Layer 3 Routing Foundations & EIGRP

8.1 IP Routing Foundations & Administrative Distance 8.2 Enhanced Interior Gateway Routing Protocol (EIGRP)

9 Chapter 9: OSPFv2 & OSPFv3 Operations

9.1 OSPFv2 Architecture & Neighbor State Machine 9.2 OSPF LSA Types & Multi-Area Design 9.3 OSPFv3 for IPv4 and IPv6 Address Families

10 Chapter 10: Border Gateway Protocol (BGP)

10.1 BGP Architecture, Neighbor States & Peering 10.2 BGP Path Attributes & Best Path Selection Algorithm

11 Chapter 11: Policy-Based Routing & Route Redistribution

11.1 Policy-Based Routing (PBR) & Route Maps 11.2 Route Redistribution & Loop Prevention

12 Chapter 12: IP Services & High Availability

12.1 First Hop Redundancy Protocols (HSRP, VRRP & GLBP) 12.2 Network Time Protocol (NTPv4) & Precision Time Protocol (PTP) 12.3 Network Address Translation (NAT/PAT) & VRF-Aware NAT

13 Chapter 13: IP Multicast Operations

13.1 IP Multicast Addressing, Group Management (IGMPv1/v2/v3) & IGMP Snooping 13.2 Protocol Independent Multicast (PIM-SM, PIM-SSM & Bidir-PIM) 13.3 Rendezvous Point (RP) Distribution Mechanisms

14 Chapter 14: Network Assurance & Monitoring

14.1 Diagnostic Utilities, Conditional Debugging & Path MTU Discovery 14.2 Syslog Architecture, Logging Facilities & Severity Levels 14.3 SNMPv1/v2c/v3 Security & Flexible NetFlow (FNF) Architecture 14.4 Switched Port Analyzer (SPAN, RSPAN, ERSPAN) & IP SLA Object Tracking

15 Chapter 15: Catalyst Center Assurance & Controller Operations

15.1 Cisco Catalyst Center (DNA Center) Assurance & AI Network Analytics 15.2 Cisco Catalyst Center Device Onboarding & Software Image Management (SWIM)

16 Chapter 16: Enterprise Security & Access Control

16.1 Device Hardening, AAA Architecture & RADIUS/TACACS+ 16.2 Access Control Lists (ACLs) for Infrastructure Security 16.3 Control Plane Policing (CoPP) & Control Plane Protection (CPPr) 16.4 Layer 2 Infrastructure Security Features 16.5 IEEE 802.1X Port-Based Authentication & MAB

17 Chapter 17: Threat Defense & API Security

17.1 Enterprise VPN Technologies (DMVPN Phase 1/2/3 & FlexVPN) 17.2 Next-Generation Threat Defense & Secure Access Service Edge (SASE)

18 Chapter 18: Network Automation, Programmability & Data Modeling

18.1 Python Fundamentals for Network Engineers & Cisco Libraries 18.2 YANG Data Modeling Language (RFC 6020/7950) & Model Types 18.3 REST API Architecture, HTTP Verbs, Security & Cisco Controller APIs 18.4 Model-Driven Telemetry (MDT) & NETCONF/RESTCONF Operations

19 Chapter 19: Orchestration, EEM & AI Operations

19.1 Configuration Management & Infrastructure as Code (Ansible & Terraform) 19.2 Cisco Embedded Event Manager (EEM) & Intent-Based Networking

16.3 Control Plane Policing (CoPP) & Control Plane Protection (CPPr)

Key Takeaways Explain This Topic AI

The Route Processor (RP) CPU represents the single point of failure in network devices; unpoliced control plane traffic storms, routing protocol attacks, and packet punting cause CPU starvation, protocol flapping (OSPF/BGP), and network-wide outages.

Control Plane Policing (CoPP) utilizes the Modular QoS CLI (MQC) framework (Class-maps, Policy-maps, Service-policies) applied globally to the virtual control-plane interface to classify, rate-limit (police), or drop traffic before reaching the RP CPU.

Control Plane Protection (CPPr) enhances CoPP by segmenting control plane traffic into three dedicated physical/logical subinterfaces: Host (traffic addressed to router interface IPs), Transit (software-switched packets with IP options), and CEF-Exception (traffic generating ICMP error punts or ARP misses).

Hardware-enforced silent drops at the ASIC/TCAM layer discard unauthorized or malicious packets instantly without taxing the RP CPU, whereas software drops force the CPU to generate ICMP Unreachable or TTL Expired packets, exacerbating DoS conditions.

A defensible CoPP policy establishes multi-tier CIR policing: routing protocols (OSPF, BGP, BFD) are granted dedicated high-bandwidth committed rates, management traffic (SSH, SNMP, NTP) is restricted to authorized subnets, and hostile/scanned traffic (Telnet, IP fragments) is dropped immediately.

Last updated: August 2026

16.2 Control Plane Policing (CoPP) & Control Plane Protection (CPPr)

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 5.2.b (CoPP), one of the two infrastructure security features named alongside ACLs, requires candidates to configure and verify Control Plane Policing (CoPP) and understand Control Plane Protection (CPPr). Candidates must master the Route Processor (RP) architecture, the Modular QoS CLI (MQC) framework applied to control-plane interfaces, packet classification using extended ACLs, CIR rate-limiting and drop actions, and the distinct subinterface architecture of CPPr (Host, Transit, and CEF-Exception subinterfaces).

In modern enterprise routing and switching architectures, packet forwarding is split between two primary domains: the Data Plane (Forwarding Engine), implemented in high-speed hardware Application-Specific Integrated Circuits (ASICs) and Ternary Content-Addressable Memory (TCAM), and the Control Plane (Route Processor / RP CPU), which handles routing protocol state machines (OSPF, EIGRP, BGP, IS-IS), Bidirectional Forwarding Detection (BFD), Spanning Tree Protocol (STP), device management sessions (SSH, SNMP), and packet exceptions.

While hardware ASICs can forward tens of millions of packets per second (Mpps) at line rate, the Route Processor CPU has finite processing capacity. If a flood of unauthorized, malformed, or high-volume traffic is punted to the RP CPU, CPU utilization spikes to 100%. This CPU starvation causes routing protocol keepalives to drop, BGP neighbors to reset, BFD timers to expire, and Spanning Tree topology change storms—collapsing the entire network even if physical links have ample available bandwidth. +---------------------------------------------------------------------------------------------------+

  • | CONTROL PLANE POLICING (CoPP) INGESTION PIPELINE |
  • +---------------------------------------------------------------------------------------------------+
  • | |
  • | [ INGRESS DATA TRAFFIC ] -----> [ HARDWARE CEF ASIC / TCAM ] ======> [ LINE-RATE EGRESS DATA ] |
  • | | |
  • | (Punt Condition) |
  • | v |
  • | =========================================== |
  • | | CONTROL PLANE POLICING (CoPP) FILTER | |
  • | | (Hardware MQC Rate Limiter & Policer) | |
  • | =========================================== |
  • | / | \ |
  • | / | \ |
  • | [ CRITICAL ROUTING ] [ AUTHORIZED MGMT ] [ HOSTILE / SCANS ] |
  • | - BGP / OSPF / EIGRP - SSH / SNMP / NTP - Telnet / Malformed |
  • | - BFD / LDP / RSVP - Strict Subnet ACLs - RFC 1918 Spoofs |
  • | | | | |
  • | (Police: 5 Mbps) (Police: 1 Mbps) (Action: DROP) |
  • | | | | |
  • | v v x (Silent Hardware Drop) |
  • | +-------------------------------------------------------------+ |
  • | | ROUTE PROCESSOR (RP CPU) | |
  • | | - OSPF Shortest Path First - BGP Best Path Computation | |
  • | | - SSH Cryptographic Tunnel - SNMP MIB Processing Engine | |
  • | +-------------------------------------------------------------+ |
  • +---------------------------------------------------------------------------------------------------+

1. Control Plane Vulnerabilities & Silent vs. Software Drops

When traffic enters a router interface, Cisco Express Forwarding (CEF) evaluates the destination IP against the hardware Forwarding Information Base (FIB) and Adjacency Table. Packets fall into three forwarding categories:

Hardware-Switched Transit Traffic: Packets whose destination matches a valid FIB entry with a resolved Layer 2 adjacency. Forwarded entirely in hardware ASICs without CPU involvement.

Direct Control/Management Plane Traffic: Packets explicitly addressed to the router's local IP addresses (e.g., SSH management sessions, BGP peering packets, OSPF multicast hello packets 224.0.0.5 , SNMP queries, ICMP pings to the router).

CEF Exception (Punted) Traffic: Data packets transiting the router that cannot be resolved in hardware and must be punted to the Route Processor CPU for software processing:

Packets containing IP Options (e.g., Record Route, Strict Source Route).

Packets exceeding interface MTU with the Don't Fragment (DF) bit set (requiring generation of ICMP Type 3 Code 4).

Packets with Time to Live TTL ≤ 1 \text{TTL} \le 1 TTL ≤ 1 (requiring generation of ICMP Type 11 Code 0 Time Exceeded).

ARP cache misses (packets destined to an unresolved subnet host triggering the RP to generate ARP requests).

Packets requiring unsupported Layer 2/Layer 3 encapsulation or fragmentation. +---------------------------------------------------------------------------------------------------+

  • | HARDWARE SILENT DROPS VS. SOFTWARE CPU DROPS |
  • +---------------------------------------------------------------------------------------------------+
  • | Drop Mechanism | Architectural Execution | Impact on Route Processor CPU |
  • | :---------------------- | :-------------------------- | :---------------------------------------- |
  • | **Hardware Silent Drop**| Executed directly in ASIC | **Zero CPU Overhead.** The packet is |
  • | **(CoPP / TCAM Drop)** | rate-limiter / TCAM table | discarded in hardware before it ever reaches|
  • | | before reaching the CPU bus | the CPU internal input queue. |
  • | **Software CPU Drop** | Forwarded across CPU bus; | **High CPU Overhead.** The RP CPU must |
  • | **(ACL / Unreachable)** | RP inspects packet, drops it,| allocate memory buffers, parse headers, |
  • | | and generates ICMP response | and generate ICMP error datagrams. |
  • +---------------------------------------------------------------------------------------------------+

Important

An effective CoPP policy relies on Hardware Silent Drops . If a router is subjected to an ICMP flood or unauthorized port scan, simply applying an ingress ACL that causes the router to generate ICMP Destination Unreachable messages will overwhelm the RP CPU. CoPP drops the traffic silently in hardware ASICs, neutralizing DoS attacks.

2. The Modular QoS CLI (MQC) Framework for CoPP

Control Plane Policing is implemented using the standardized three-step Modular QoS CLI (MQC) architecture: +---------------------------------------------------------------------------------------------------+

  • | THE 3-STEP MQC CONFIGURATION PIPELINE |
  • +---------------------------------------------------------------------------------------------------+
  • | |
  • | STEP 1: CLASS-MAP (Traffic Classification) |
  • | - Identifies and groups traffic matching specific criteria using Extended ACLs: |
  • | * 'class-map match-any COPP-ROUTING-CLASS' |
  • | * 'class-map match-any COPP-MANAGEMENT-CLASS' |
  • | * 'class-map match-any COPP-UNDESIRABLE-CLASS' |
  • | |
  • | STEP 2: POLICY-MAP (Action Enforcement & Rate Limiting) |
  • | - Defines QoS actions per traffic class using Committed Information Rate (CIR) policing: |
  • | * Critical Class: 'police cir 5000000 conform-action transmit exceed-action transmit' |
  • | * Normal Class: 'police cir 1000000 conform-action transmit exceed-action drop' |
  • | * Hostile Class: 'drop' |
  • | |
  • | STEP 3: SERVICE-POLICY (Global Control Plane Attachment) |
  • | - Attaches the policy-map directly to the global virtual control-plane: |
  • | * 'control-plane' |
  • | * 'service-policy input COPP-GLOBAL-POLICY' |
  • +---------------------------------------------------------------------------------------------------+
  • Multi-Tier Traffic Classification Architecture

A robust enterprise CoPP policy structures traffic into prioritized functional classes:

Traffic Class Protocol Composition & Matching ACLs Target Action & Rate Limiting Strategy

Critical Routing OSPF (IP Proto 89), EIGRP (IP Proto 88), BGP (TCP 179), BFD (UDP 3784/3785), LDP (TCP/UDP 646), VRRP/HSRP High CIR rate (e.g., 5–10 Mbps). Exceed action set to transmit or high burst allowance to guarantee zero control protocol drops.

Authorized Mgmt SSH (TCP 22), SNMP (UDP 161), NTP (UDP 123), TACACS+ (TCP 49), RADIUS (UDP 1812/1813) from authorized subnets Medium CIR rate (e.g., 1–2 Mbps). Conforming traffic transmitted; exceeding traffic dropped. Restricted strictly to trusted admin prefixes.

Diagnostic / Normal ICMP Echo Requests, Traceroute probes, ARP requests, IGMP/MLD group memberships Moderate CIR rate (e.g., 250–500 kbps). Aggressive exceed drop to eliminate ping floods.

Undesirable / Attack Telnet (TCP 23), HTTP (TCP 80), IP fragments, IP Options, RFC 1918 spoofing from public interfaces Drop immediately ( drop action) without rate limiting.

Class-Default All unclassified residual control plane traffic Low catch-all rate (e.g., 100 kbps) with drop exceed action to absorb unexpected traffic bursts.

Loading diagram... CoPP Modular QoS CLI (MQC) Token-Bucket Rate Limiting Pipeline

3. Control Plane Protection (CPPr) Subinterfaces

While CoPP applies a single global policy to the entire control plane, Control Plane Protection (CPPr) provides granular protection by dividing the control plane into three distinct virtual subinterfaces: +---------------------------------------------------------------------------------------------------+

  • | CONTROL PLANE PROTECTION (CPPr) SUBINTERFACES |
  • +---------------------------------------------------------------------------------------------------+
  • | |
  • | 1. HOST SUBINTERFACE ('control-plane host') |
  • | - Intercepts all traffic destined directly to the router's local physical or logical IPs. |
  • | - Protocols: SSH, Telnet, SNMP, NTP, BGP peering, RADIUS/TACACS+ replies, local ICMP pings. |
  • | - Feature Support: Full MQC policing, Port-Filtering, and Closed User Groups (CUG). |
  • | |
  • | 2. TRANSIT SUBINTERFACE ('control-plane transit') |
  • | - Intercepts non-exception data traffic that transits through the router but requires software|
  • | handling by the Route Processor CPU. |
  • | - Packets: Packets with IP Options (Record Route, Timestamp), unsupported tunnel types, |
  • | and Layer 2 metadata punts. |
  • | |
  • | 3. CEF-EXCEPTION SUBINTERFACE ('control-plane cef-exception') |
  • | - Intercepts data packets that trigger hardware CEF exceptions and force the RP CPU to |
  • | generate error responses or perform Layer 2 address resolution. |
  • | - Packets: Packets with TTL <= 1 (generating ICMP Time Exceeded), packets exceeding MTU |
  • | with DF=1 (generating ICMP Fragmentation Needed), and ARP resolution misses. |

+---------------------------------------------------------------------------------------------------+ +---------------------------------------------------------------------------------------------------+

  • | CoPP VS. CPPr ARCHITECTURAL COMPARISON |
  • +---------------------------------------------------------------------------------------------------+
  • | Architectural Feature | Control Plane Policing (CoPP) | Control Plane Protection (CPPr)|
  • | :-------------------------- | :---------------------------------- | :---------------------------- |
  • | **Attachment Point** | Global virtual `control-plane` | Three dedicated subinterfaces: |
  • | | interface | `host`, `transit`, `cef-exception`|
  • | **Granularity** | Coarse / Aggregate control plane | Granular per-subinterface |
  • | | bucket | isolation |
  • | **Port-Filtering Feature** | Not supported | **Supported** on Host subif |
  • | | | (Drops closed ports instantly) |
  • | **CEF Exception Isolation** | Mixed with general control traffic | **Dedicated CEF-Exception subif|
  • | | | (Prevents ICMP storm punts) |
  • | **Queue Architecture** | Single aggregate hardware queue | Dedicated hardware queues per |
  • | | | subinterface category |
  • +---------------------------------------------------------------------------------------------------+
  • CPPr Port-Filtering and Closed User Groups (CUG)

On the Host subinterface, CPPr introduces Port-Filtering :

Network devices listen on various standard UDP/TCP ports. Attackers scan devices by probing unused ports, forcing the RP CPU to process the transport header and generate ICMP Port Unreachable responses.

CPPr Port-Filtering allows administrators to define a whitelist of permitted open ports (e.g., TCP 22 for SSH, BGP 179). Any packet arriving for a non-whitelisted port is dropped silently in hardware before reaching the host input queue.

  • 4. Cisco IOS-XE CoPP & CPPr Configuration & Verification
  • Step-by-Step CoPP Configuration Example ! Step 1: Define Extended Access Control Lists for Traffic Categories
  • ip access-list extended ACL-COPP-CRITICAL-ROUTING
  • permit ospf any any
  • permit eigrp any any
  • permit tcp any eq bgp any
  • permit tcp any any eq bgp
  • permit udp any eq 3784 any
  • permit udp any any eq 3784

!

  • ip access-list extended ACL-COPP-MGMT-AUTHORIZED
  • permit tcp 10.1.100.0 0.0.0.255 any eq 22
  • permit udp 10.1.100.0 0.0.0.255 any eq snmp
  • permit udp 10.1.100.0 0.0.0.255 any eq ntp

!

  • ip access-list extended ACL-COPP-DIAGNOSTIC-ICMP
  • permit icmp any any echo
  • permit icmp any any echo-reply
  • permit icmp any any time-exceeded
  • permit icmp any any unreachable

!

  • ip access-list extended ACL-COPP-UNDESIRABLE
  • permit tcp any any eq telnet
  • permit tcp any any eq www
  • permit ip host 0.0.0.0 any
  • permit ip 10.0.0.0 0.255.255.255 any

!

  • ! Step 2: Define MQC Class-Maps
  • class-map match-any CLASS-COPP-ROUTING
  • match access-group name ACL-COPP-CRITICAL-ROUTING
  • class-map match-any CLASS-COPP-MGMT
  • match access-group name ACL-COPP-MGMT-AUTHORIZED
  • class-map match-any CLASS-COPP-DIAG
  • match access-group name ACL-COPP-DIAGNOSTIC-ICMP
  • class-map match-any CLASS-COPP-BAD
  • match access-group name ACL-COPP-UNDESIRABLE

!

  • ! Step 3: Define MQC Policy-Map with Multi-Tier Committed Information Rates (CIR)
  • policy-map POLICY-COPP-ENTERPRISE
  • class CLASS-COPP-ROUTING
  • police cir 10000000 bc 312500
  • conform-action transmit
  • exceed-action transmit
  • class CLASS-COPP-MGMT
  • police cir 2000000 bc 62500
  • conform-action transmit
  • exceed-action drop
  • class CLASS-COPP-DIAG
  • police cir 500000 bc 15625
  • conform-action transmit
  • exceed-action drop
  • class CLASS-COPP-BAD
  • drop
  • class class-default
  • police cir 100000 bc 3125
  • conform-action transmit
  • exceed-action drop

!

  • ! Step 4: Attach Policy-Map to Global Control-Plane Interface (CoPP)
  • control-plane
  • service-policy input POLICY-COPP-ENTERPRISE
  • CPPr Subinterface Attachment Example ! Attaching granular policies to CPPr Subinterfaces
  • control-plane host
  • service-policy input POLICY-CPPR-HOST

!

  • control-plane transit
  • service-policy input POLICY-CPPR-TRANSIT

!

  • control-plane cef-exception
  • service-policy input POLICY-CPPR-CEF-EXCEPTION
  • CoPP Operational Verification & Counter Inspection Router# show policy-map control-plane
  • Control Plane

Service-policy input: POLICY-COPP-ENTERPRISE

  • Class-map: CLASS-COPP-ROUTING (match-any)
  • 1248900 packets, 114898800 bytes
  • 5 minute offered rate 12000 bps, drop rate 0000 bps
  • Match: access-group name ACL-COPP-CRITICAL-ROUTING

police:

cir 10000000 bps, bc 312500 bytes

conformed 1248900 pkts, 114898800 bytes; actions:

transmit

exceeded 0 pkts, 0 bytes; actions:

  • transmit
  • conformed 12000 bps, exceeded 0000 bps
  • Class-map: CLASS-COPP-DIAG (match-any)
  • 985420 packets, 82775280 bytes
  • 5 minute offered rate 145000 bps, drop rate 82000 bps
  • Match: access-group name ACL-COPP-DIAGNOSTIC-ICMP

police:

cir 500000 bps, bc 15625 bytes

conformed 412000 pkts, 34608000 bytes; actions:

transmit

exceeded 573420 pkts, 48167280 bytes; actions:

  • drop
  • conformed 500000 bps, exceeded 82000 bps
  • Class-map: CLASS-COPP-BAD (match-any)
  • 142055 packets, 11932620 bytes
  • 5 minute offered rate 42000 bps, drop rate 42000 bps
  • Match: access-group name ACL-COPP-UNDESIRABLE
  • drop