Question

A network engineer configured CoPP on a core router to protect the control plane. After applying the policy, users report that transit traffic passing through the router is unaffected, but a newly added deny-all class at the end of the policy-map (applied to catch unclassified traffic to the router itself) is dropping legitimate SSH sessions to the device from a management subnet. The management subnet was intentionally omitted from the permit ACLs. Which characteristic of CoPP explains why only the router-destined SSH traffic is impacted and not the transit traffic?

Accepted Answer

CoPP applied to the control-plane only inspects traffic destined to the router itself (punted to the control plane), so transit traffic bypasses the policy entirely.

Answer

CoPP is applied bidirectionally on all data interfaces, so transit traffic is exempt only because it uses hardware forwarding.

Answer

CoPP evaluates transit traffic first and only applies drop actions after the routing table lookup completes for locally destined packets.

Answer

CoPP uses a separate transit sub-interface policy that must be explicitly enabled with the 'service-policy transit' command to affect forwarded traffic.