OcNOS DC : System Management Guide : Monitor and Reporting Server Configuration : Control Plane Policing Configuration
Control Plane Policing Configuration
This chapter contains basic information and a sample configuration of CPU queue properties. The device has multiple CPU queues for managing and classifying control traffic and offers rate limiters for control plane protection. Various types of CPU port-bound packets are queued into different CPU queues, each with different properties such as rate, queue limit, monitoring status, and drop status.
Control plane policing (CoPP) manages the traffic flow destined to the host router CPU for control plane processing. CoPP limits the traffic forwarded to the host CPU and avoids impact on system performance.
1. CoPP has organized the handling of control packets by providing per-protocol hardware CPU queues. So, control packets are queued in different CPU queues based on protocol.
2. Per-protocol CPU queue rate limits and buffer allocations are programmed during router initialization, thus, every CPU queue is rate-limited to a default stable and balanced behavior across protocols.
3. When control packets are received at a higher rate than the programmed rate, the excess traffic is dropped at the queue level in the packet processor hardware itself.
4. All CPU queues are pre-programmed with default rate limits and buffer allocations to ensure a default stable and balanced behavior across protocols.
Topology
A network traffic simulator device connects to a router (R1) to generate and send various types of network traffic. The router, which has CoPP configured, manages and limits traffic destined for its CPU using multiple CPU queues with specific properties for different control traffic types. Another traffic simulator device connects to the router to generate or receive traffic, testing the router's CPU queues and CoPP configurations to handle different traffic loads and types.
 
Simple configuration of CPU Queuing
The CPU queue rates are listed for each protocol queue.
 
Table 4-39: Default CPU queues
Protocol Queues
Default Rate in packets per second (PPS)
Maximum configurable rate in (PPS)
Best-effort
2113
2113
IPMC-miss
2113
2113
L3-miss
211
211
Sflow
32000
100000
BGP
1500
1500
VRRP
1024
1024
RIP
500
500
OSPF
2000
2000
DHCP
100
2048
ND
6000
6000
PIM
4000
4000
ARP
6000
6000
IGMP
4000
4000
BPDU
10000
10000
CCM
1000
1000
BFD
2000
2000
PTP
1000
1000
IS-IS
500
1000
TRILL-IS-IS
1000
1000
ACL
200
200
VXLAN
500
500
DAIVM
100
500
Validate the default CPU queue rates by using the command show cpu-queue details.
R1#show cpu-queue details
* - Can not configure the parameter
Cpu queue Rate In PPS Monitor Status Lossy Status
Name Configured Default Max Rate Allowed Configured Default Configured Default
=========== ========== ======= ================ =========== ========== =========== ==========
best-effort - 2113 2113 - * no-monitor - * lossy
ipmc-miss - 2113 2113 - * no-monitor - * lossy
l3-miss - 211 211 - * no-monitor - * lossy
sflow - 32000 100000 - monitor - * lossy
bgp - 1500 1500 - monitor - lossless
vrrp - 1024 1024 - monitor - lossless
rip - 500 500 - monitor - lossless
ospf - 2000 2000 - monitor - lossless
dhcp - 100 2048 - no-monitor - lossy
nd - 6000 6000 - monitor - lossless
pim - 4000 4000 - * no-monitor - * lossy
arp - 6000 6000 - monitor - lossless
igmp - 4000 4000 - * no-monitor - * lossy
bpdu - 10000 10000 - monitor - lossless
ccm - 1000 1000 - no-monitor - lossy
bfd - 2000 2000 - no-monitor - lossy
ptp - 1000 1000 - no-monitor - lossy
isis - 500 1000 - monitor - lossless
trill-isis - 1000 1000 - monitor - lossless
acl - 200 1000 - * no-monitor - * lossy
vxlan - 500 500 - monitor - lossy
daivm - 100 500 - no-monitor - lossy
Note:  
• Enable the feature before validating the CPU queue for each protocol.
• The monitor option starts generating operational logs for the number of dropped packets and the percentage.
OcNOS(config)#2021 Nov 16 11:40:24.188 : OcNOS : HSL : CRITI : [CPU_QUEUE_IS_FULL_2]: 967368133 packets dropped at queue bpdu due to queue full. Average CPU queue rate is 99% (499 pkts/sec).
Configuring CPU Queuing Lossless
The CPU queue is configured to prevent packet loss by ensuring all BPDU packets are processed without being dropped.
To ensure no BPDU packets are dropped, configure the BPDU CPU queue with a rate of 600 PPS and set it to lossless with the no-monitor option.
R1#configure terminal
R1(config)#cpu-queue bpdu rate 600 lossless no monitor
R1(config)#exit
 
Validation
Confirm the configurations with the following commands:
R1#show running-config | in cpu
cpu-queue bpdu rate 600 lossless no-monitor
 
R2#show cpu-queue details
* - Can not configure the parameter
Cpu queue Rate In PPS Monitor Status Lossy Status
Name Configured Default Max Rate Allowed Configured Default Configured Default
=========== ========== ======= ================ =========== ========== =========== ==========
best-effort - 2113 2113 - * no-monitor - * lossy
ipmc-miss - 2113 2113 - * no-monitor - * lossy
l3-miss - 211 211 - * no-monitor - * lossy
sflow - 32000 100000 - monitor - * lossy
bgp - 1500 1500 - monitor - lossless
vrrp - 1024 1024 - monitor - lossless
rip - 500 500 - monitor - lossless
ospf - 2000 2000 - monitor - lossless
dhcp - 100 2048 - no-monitor - lossy
nd - 6000 6000 - monitor - lossless
pim - 4000 4000 - * no-monitor - lossy
arp - 6000 6000 - monitor - lossless
igmp - 4000 4000 - * no-monitor - * lossy
bpdu 600 10000 10000 no-monitor monitorloss less lossless
ccm - 1000 1000 - no-monitor - lossy
bfd - 2000 2000 - no-monitor - lossy
ptp - 1000 1000 - no-monitor - lossy
isis - 500 1000 - monitor - lossless
trill-isis - 1000 1000 - monitor - lossless
acl - 200 1000 - * no-monitor - * lossy
vxlan - 500 500 - monitor - lossy
daivm - 100 500 - no-monitor - lossy
 
R1#show interface cpu counters rate kbps
Load interval: 30 second
+-------------------+--------------+-------------+--------------+-------------+
| CPU Queue(%) | Rx kbps | Rx pps | Tx kbps | Tx pps |
+-------------------+--------------+-------------+--------------+-------------+
bpdu ( 99%) - - 38.41 599
 
R1#show interface cpu counters queue-stats
E - Egress, I - Ingress, Q-Size is in bytes
* indicates monitor is active
+-------------+--------------------+--------+-----------------+-------------------+-----------------+-------------------+
| Interface | Queue/Class-map | Q-Size | Tx pkts | Tx bytes | Dropped pkts | Dropped bytes |
+-------------+--------------------+--------+-----------------+-------------------+-----------------+-------------------+
cpu bpdu (E) 320736 21703 1388992 5363326 343240064
Configuring CPU Queuing Lossy
The CPU queue is configured to allow packet loss if the queue exceeds its processing capacity.
To allow BPDU packets to be dropped, configure the BPDU CPU queue with a rate of 500 PPS and set it to lossy with the no-monitor option.
R1#configure terminal
R1(config)#cpu-queue bpdu rate 500 lossy no monitor
R1(config)#exit
Validation
Confirm the configurations with the following commands:
R1#show running-config | in cpu
cpu-queue bpdu rate 500 lossy no-monitor
 
R1#show cpu-queue details
* - Can not configure the parameter
Cpu queue Rate In PPS Monitor Status Lossy Status
Name Configured Default Max Rate Allowed Configured Default Configured Default
=========== ========== ======= ================ =========== ========== =========== ==========
best-effort - 2113 2113 - * no-monitor - * lossy
ipmc-miss - 2113 2113 - * no-monitor - * lossy
l3-miss - 211 211 - * no-monitor - * lossy
sflow - 32000 100000 - monitor - * lossy
bgp - 1500 1500 - monitor - lossless
vrrp - 1024 1024 - monitor - lossless
rip - 500 500 - monitor - lossless
ospf - 2000 2000 - monitor - lossless
dhcp - 100 2048 - no-monitor - lossy
nd - 6000 6000 - monitor - lossless
pim - 4000 4000 - * no-monitor - * lossy
arp - 6000 6000 - monitor - lossless
igmp - 4000 4000 - * no-monitor - * lossy
bpdu 500 10000 10000 no-monitor monitor lossy lossless
ccm - 1000 1000 - no-monitor - lossy
bfd - 2000 2000 - no-monitor - lossy
ptp - 1000 1000 - no-monitor - lossy
isis - 500 1000 - monitor - lossless
trill-isis - 1000 1000 - monitor - lossless
acl - 200 1000 - * no-monitor - * lossy
vxlan - 500 500 - monitor - lossy
daivm - 100 500 - no-monitor - lossy
 
R1#show interface cpu counters queue-stats
E - Egress, I - Ingress, Q-Size is in bytes
* indicates monitor is active
+-------------+--------------------+--------+-----------------+-------------------+-----------------+-------------------+
| Interface | Queue/Class-map | Q-Size | Tx pkts | Tx bytes | Dropped pkts | Dropped bytes |
+-------------+--------------------+--------+-----------------+-------------------+-----------------+-------------------+
cpu nd (E) 0 17 1998 0 0
cpu bpdu (E) 86320 153802 9843328 39667426 2538702464
 
R1#show interface cpu counters rate kbps
Load interval: 30 second
+-------------------+--------------+-------------+--------------+-------------+
| CPU Queue(%) | Rx kbps | Rx pps | Tx kbps | Tx pps |
+-------------------+--------------+-------------+--------------+-------------+
bpdu ( 99%) - - 31.97 499