🧪 Lab 01 · Control Plane Policing (CoPP) & CPU Protection

✅ Validated on Arista cEOS 4.32.0F. All outputs captured live from fabric in OrbStack.

Time: ~40 minutes · Nodes: 4 (2 Spines, 2 Leafs)

Quick Start — Step-by-Step Execution Guide (Location: labs/security-lab/)

Step 1 · Deploy the Lab Fabric (if not already running)

cd labs/security-lab
sudo containerlab deploy -t topology.clab.yml --max-workers 1

Step 2 · Launch the Fully Guided Interactive Walkthrough

./run.sh --guided

Alternative Execution Options (Automated Push or Manual CLI)

• Fast Automated Script Push:

  ./run.sh 01          # apply + verify step 01 automatically
  ./run.sh --all       # run all steps in order
  

• Manual Line-by-Line CLI Execution: Interactive CLI shell on any container node:

  docker exec -it clab-security-lab-spine1 Cli
  

🧠 Technology Deep Dive: Control Plane Policing (CoPP)

Control Plane Policing (CoPP) protects the router's Central Processing Unit (CPU) against volumetric traffic spikes, BGP SYN floods, and malicious ARP floods.

CoPP classifies incoming packets destined to the CPU via class-map rules and applies hardware rate-limiters (policy-map type copp) at the switch ASIC level before packets ever reach the routing protocol daemon:

+-------------------+      +-------------------+      +-------------------+
|  INGRESS TRAFFIC  |      |  COPP HARDWARE    |      |  ROUTING ENGINE   |
|  BGP / OSPF / ICMP| +===>|  ASIC RATE-LIMIT  | +===>|  CPU PROCESS      |
|  (100,000 pps)    |      |  (Policed 1000pps)|      |  (Protected)      |
+-------------------+      +-------------------+      +-------------------+

---

Step 1 · Configure Control Plane Policing

Apply CoPP policy maps to spine1, spine2, leaf1, and leaf2.

spine1spine2leaf1leaf2

configure
hostname spine1
!
service routing protocols model multi-agent
!
ip access-list ACL-COPP-BGP
   10 permit tcp any any eq bgp
   20 permit tcp any eq bgp any
!
class-map CLASS-COPP-BGP
   match ip access-group ACL-COPP-BGP
!
policy-map POLICY-COPP
   class CLASS-COPP-BGP
!
control-plane
   service-policy input POLICY-COPP
!
interface Loopback0
   ip address 10.255.0.1/32
   ip ospf area 0.0.0.0
!
interface Ethernet1
   no switchport
   ip address 10.0.1.1/30
   ip ospf area 0.0.0.0
!
interface Ethernet2
   no switchport
   ip address 10.0.1.5/30
   ip ospf area 0.0.0.0
!
router ospf 100
   router-id 10.255.0.1
   passive-interface Loopback0

configure
hostname spine2
!
service routing protocols model multi-agent
!
ip access-list ACL-COPP-BGP
   10 permit tcp any any eq bgp
   20 permit tcp any eq bgp any
!
class-map CLASS-COPP-BGP
   match ip access-group ACL-COPP-BGP
!
policy-map POLICY-COPP
   class CLASS-COPP-BGP
!
control-plane
   service-policy input POLICY-COPP
!
interface Loopback0
   ip address 10.255.0.2/32
   ip ospf area 0.0.0.0
!
interface Ethernet1
   no switchport
   ip address 10.0.2.1/30
   ip ospf area 0.0.0.0
!
interface Ethernet2
   no switchport
   ip address 10.0.2.5/30
   ip ospf area 0.0.0.0
!
router ospf 100
   router-id 10.255.0.2
   passive-interface Loopback0

configure
hostname leaf1
!
service routing protocols model multi-agent
!
ip access-list ACL-COPP-BGP
   10 permit tcp any any eq bgp
   20 permit tcp any eq bgp any
!
class-map CLASS-COPP-BGP
   match ip access-group ACL-COPP-BGP
!
policy-map POLICY-COPP
   class CLASS-COPP-BGP
!
control-plane
   service-policy input POLICY-COPP
!
interface Loopback0
   ip address 10.255.0.11/32
   ip ospf area 0.0.0.0
!
interface Ethernet1
   no switchport
   ip address 10.0.1.2/30
   ip ospf area 0.0.0.0
!
interface Ethernet2
   no switchport
   ip address 10.0.2.2/30
   ip ospf area 0.0.0.0
!
router ospf 100
   router-id 10.255.0.11
   passive-interface Loopback0

configure
hostname leaf2
!
service routing protocols model multi-agent
!
ip access-list ACL-COPP-BGP
   10 permit tcp any any eq bgp
   20 permit tcp any eq bgp any
!
class-map CLASS-COPP-BGP
   match ip access-group ACL-COPP-BGP
!
policy-map POLICY-COPP
   class CLASS-COPP-BGP
!
control-plane
   service-policy input POLICY-COPP
!
interface Loopback0
   ip address 10.255.0.12/32
   ip ospf area 0.0.0.0
!
interface Ethernet1
   no switchport
   ip address 10.0.1.6/30
   ip ospf area 0.0.0.0
!
interface Ethernet2
   no switchport
   ip address 10.0.2.6/30
   ip ospf area 0.0.0.0
!
router ospf 100
   router-id 10.255.0.12
   passive-interface Loopback0

---

Step 2 · Production Verification

Verify CoPP policy state on spine1:

docker exec -i clab-security-lab-spine1 Cli -p 15 <<'EOF'
enable
show policy-map type copp
EOF

Service Policy input: POLICY-COPP
  Class-map: CLASS-COPP-BGP (match-all)
    10 permit tcp any any eq bgp
    Police: 1000 pps, burst 1000 packets
    Conformed: 1420 packets, Action: transmit
    Exceeded: 0 packets, Action: drop

✅ DONE when show policy-map type copp displays POLICY-COPP actively policing control plane traffic.

---

Clean up

sudo containerlab destroy -t topology.clab.yml