Question

A network engineer configures CoPP on a core router to rate-limit management traffic. After applying the policy, administrators report they can no longer reach the router via HTTPS for the web GUI, but SSH still works fine. The relevant configuration is shown below:

ip access-list extended MGMT-TRAFFIC
 permit tcp any any eq 22
 permit tcp any any eq 80
class-map match-all MGMT
 match access-group name MGMT-TRAFFIC
policy-map COPP-POLICY
 class MGMT
  police 8000 conform-action transmit exceed-action transmit
 class class-default
  police 8000 conform-action transmit exceed-action drop
control-plane
 service-policy input COPP-POLICY

What is the most likely cause of the HTTPS connectivity failure?

Accepted Answer

The ACL matches TCP port 80 (HTTP) but not TCP port 443 (HTTPS), so HTTPS traffic falls into class-default and is subject to the exceed-action drop.

Answer

The police rate of 8000 bps is too low for HTTPS sessions, causing the TLS handshake packets to be dropped in the MGMT class.

Answer

CoPP does not support HTTPS traffic and requires a separate management-plane policy using the control-plane host subinterface.

Answer

The service-policy must be applied in the output direction for HTTPS return traffic to be permitted.