Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2SecurityMedium
A network security team is implementing infrastructure security measures on a Cisco router. They want to protect the router's CPU from excessive traffic during a denial-of-service (DoS) attack, specifically targeting management protocols like Telnet, SSH, and SNMP. Which security mechanism should be configured to rate-limit and filter these types of packets destined for the router's control plane?
- AManagement Plane Policing (MPP)
- BUnicast Reverse Path Forwarding (uRPF)
- CData Plane Policing (DPP)
- DControl Plane Policing (CoPP)
Show answer & explanationAnswer & explanation
Correct answer: D. Control Plane Policing (CoPP)
Control Plane Policing (CoPP) is designed to protect the router's CPU (control plane) from excessive traffic, including attacks and legitimate but high-volume traffic, by classifying and rate-limiting packets destined to the router itself. This directly targets the protection of management protocols like Telnet, SSH, and SNMP.
Why the other options are wrong
- A. Management Plane Policing (MPP) is a simpler, less granular feature focused on protecting management interfaces (e.g., VTY, console, aux) from management traffic.
- B. Unicast Reverse Path Forwarding (uRPF) helps mitigate IP spoofing by verifying the source IP address of packets, not protecting the control plane directly.
- C. Data Plane Policing (DPP) applies rate limiting to user data traffic transiting the router.
Control Plane Policing (CoPP)
A Cisco IOS feature that protects the router's CPU (control plane) from excessive traffic, including malicious attacks and legitimate overhead, by applying QoS policies to traffic destined for the router itself.
- Uses a modular QoS command-line interface (MQC) to classify and police traffic.
- Protects management protocols (SSH, Telnet, SNMP), routing protocols (OSPF, EIGRP), and infrastructure protocols (ARP, ICMP).
- Prevents DoS attacks from overwhelming the CPU and impacting router stability.
- Operates on traffic destined to the router, not traffic transiting it.
Memory trick: Planes Operate: Control for CPU, Data for Forwarding, Management for Access