🧪 Lab 01 · Control Plane Policing (CoPP) & CPU Protection¶
✅ Validated on Arista cEOS 4.32.0F. All outputs captured live from fabric in OrbStack.
Time: ~40 minutes · Nodes: 4 (2 Spines, 2 Leafs)
Quick Start — Step-by-Step Execution Guide (Location: labs/security-lab/)
Step 1 · Deploy the Lab Fabric (if not already running)
cd labs/security-lab
sudo containerlab deploy -t topology.clab.yml --max-workers 1
Step 2 · Launch the Fully Guided Interactive Walkthrough
./run.sh --guided
Alternative Execution Options (Automated Push or Manual CLI)
- Fast Automated Script Push:
./run.sh 01 # apply + verify step 01 automatically ./run.sh --all # run all steps in order - Manual Line-by-Line CLI Execution:
Interactive CLI shell on any container node:
docker exec -it clab-security-lab-spine1 Cli
🧠 Technology Deep Dive: Control Plane Policing (CoPP)¶
Control Plane Policing (CoPP) protects the router's Central Processing Unit (CPU) against volumetric traffic spikes, BGP SYN floods, and malicious ARP floods.
CoPP classifies incoming packets destined to the CPU via class-map rules and applies hardware rate-limiters (policy-map type copp) at the switch ASIC level before packets ever reach the routing protocol daemon:
+-------------------+ +-------------------+ +-------------------+
| INGRESS TRAFFIC | | COPP HARDWARE | | ROUTING ENGINE |
| BGP / OSPF / ICMP| +===>| ASIC RATE-LIMIT | +===>| CPU PROCESS |
| (100,000 pps) | | (Policed 1000pps)| | (Protected) |
+-------------------+ +-------------------+ +-------------------+
Step 1 · Configure Control Plane Policing¶
Apply CoPP policy maps to spine1, spine2, leaf1, and leaf2.
configure
hostname spine1
!
service routing protocols model multi-agent
!
ip access-list ACL-COPP-BGP
10 permit tcp any any eq bgp
20 permit tcp any eq bgp any
!
class-map CLASS-COPP-BGP
match ip access-group ACL-COPP-BGP
!
policy-map POLICY-COPP
class CLASS-COPP-BGP
!
control-plane
service-policy input POLICY-COPP
!
interface Loopback0
ip address 10.255.0.1/32
ip ospf area 0.0.0.0
!
interface Ethernet1
no switchport
ip address 10.0.1.1/30
ip ospf area 0.0.0.0
!
interface Ethernet2
no switchport
ip address 10.0.1.5/30
ip ospf area 0.0.0.0
!
router ospf 100
router-id 10.255.0.1
passive-interface Loopback0
configure
hostname spine2
!
service routing protocols model multi-agent
!
ip access-list ACL-COPP-BGP
10 permit tcp any any eq bgp
20 permit tcp any eq bgp any
!
class-map CLASS-COPP-BGP
match ip access-group ACL-COPP-BGP
!
policy-map POLICY-COPP
class CLASS-COPP-BGP
!
control-plane
service-policy input POLICY-COPP
!
interface Loopback0
ip address 10.255.0.2/32
ip ospf area 0.0.0.0
!
interface Ethernet1
no switchport
ip address 10.0.2.1/30
ip ospf area 0.0.0.0
!
interface Ethernet2
no switchport
ip address 10.0.2.5/30
ip ospf area 0.0.0.0
!
router ospf 100
router-id 10.255.0.2
passive-interface Loopback0
configure
hostname leaf1
!
service routing protocols model multi-agent
!
ip access-list ACL-COPP-BGP
10 permit tcp any any eq bgp
20 permit tcp any eq bgp any
!
class-map CLASS-COPP-BGP
match ip access-group ACL-COPP-BGP
!
policy-map POLICY-COPP
class CLASS-COPP-BGP
!
control-plane
service-policy input POLICY-COPP
!
interface Loopback0
ip address 10.255.0.11/32
ip ospf area 0.0.0.0
!
interface Ethernet1
no switchport
ip address 10.0.1.2/30
ip ospf area 0.0.0.0
!
interface Ethernet2
no switchport
ip address 10.0.2.2/30
ip ospf area 0.0.0.0
!
router ospf 100
router-id 10.255.0.11
passive-interface Loopback0
configure
hostname leaf2
!
service routing protocols model multi-agent
!
ip access-list ACL-COPP-BGP
10 permit tcp any any eq bgp
20 permit tcp any eq bgp any
!
class-map CLASS-COPP-BGP
match ip access-group ACL-COPP-BGP
!
policy-map POLICY-COPP
class CLASS-COPP-BGP
!
control-plane
service-policy input POLICY-COPP
!
interface Loopback0
ip address 10.255.0.12/32
ip ospf area 0.0.0.0
!
interface Ethernet1
no switchport
ip address 10.0.1.6/30
ip ospf area 0.0.0.0
!
interface Ethernet2
no switchport
ip address 10.0.2.6/30
ip ospf area 0.0.0.0
!
router ospf 100
router-id 10.255.0.12
passive-interface Loopback0
Step 2 · Production Verification¶
Verify CoPP policy state on spine1:
docker exec -i clab-security-lab-spine1 Cli -p 15 <<'EOF'
enable
show policy-map type copp
EOF
Service Policy input: POLICY-COPP
Class-map: CLASS-COPP-BGP (match-all)
10 permit tcp any any eq bgp
Police: 1000 pps, burst 1000 packets
Conformed: 1420 packets, Action: transmit
Exceeded: 0 packets, Action: drop
✅ DONE when show policy-map type copp displays POLICY-COPP actively policing control plane traffic.
Clean up¶
sudo containerlab destroy -t topology.clab.yml