Question

A network engineer configured CoPP on a core router to protect the control plane. After applying the policy, administrators report intermittent SSH session timeouts to the router, while ping and OSPF adjacencies remain stable. The relevant configuration is:

class-map match-all COPP-MGMT
 match access-group name SSH-ACL
!
policy-map COPP-POLICY
 class COPP-MGMT
  police 8000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

The SSH-ACL correctly matches TCP port 22 to the router loopback. The command 'show policy-map control-plane' shows a steadily increasing number of exceeded (dropped) packets in class COPP-MGMT. What is the most likely cause?

Accepted Answer

The police rate of 8000 bps is too low for SSH traffic, causing legitimate management packets to exceed the policer and be dropped.

Answer

CoPP policies cannot be applied in the input direction and must use the output direction to permit SSH.

Answer

The class-map uses match-all, which prevents any SSH packets from matching a single ACL.

Answer

SSH traffic is process-switched and therefore bypasses the control-plane policy entirely.