A service provider engineer notices that a PE router's route processor CPU spikes to 95% whenever a customer misconfigures a routing peer and floods the router with excessive BGP and ICMP traffic destined to the router itself. The engineer wants to protect the route processor by rate-limiting traffic punted to the control plane, while still permitting legitimate protocol sessions to establish. Which mechanism should be configured to achieve this?