Configure Basic Functions of CPU Protection
Network Requirements
- PC is connected to IP Network via Device.
- Configure the SVI-IP packet to queue 5 on Device so that the SVI-IP packet that reaches the local device can first get the CPU processing.
- Perform the rate limitation for the ARP queue on Device so that when the CPU utilization of Device is too high, the packet with low priority can be processed normally.
Network Topology
![Networking of configuring the CPU protection basic functions](/storage/images/Document/Maipu/security/config-cpu-protection.jpg)
Figure 2–1 Networking of configuring the CPU protection basic functions
Configuration Steps
Step 1: Configure VLAN and add the port to the corresponding VLAN. (Omitted)
Step 2: Configure the IP address of the interface. (Omitted)
Step 3: Configure the CPU queue of the SVI-IP packet.
# Configure the SVI-IP packet to queue 5 on Device.
Device#configure terminal
Device(config)#cpu-packet svi-ip cos 5
|
Step 4: Configure the rate limitation of the CPU queue.
# Configure the limited rate of the CPU queue on Device as 50pps.
Device(config)#cpu-packet cos 1 pps 50
|
Step 5: Check the result.
#View the CPU queue of the protocol packets on Device.
Device#show cpu-packet cos
Type Current-CoS [Default-CoS]
random 0 [0]
ipv6-all 0 [0]
pppoe 0 [0]
udp-broadcast 0 [0]
icmp 0 [0]
ip-e-packet 0 [0]
ipsec-esp 0 [0]
ipsec-ah 0 [0]
ip 0 [0]
mpls-unicast 0 [0]
mpls-multicast 0 [0]
LBD_l2-src-miss 0 [0]
ipaddr-0 0 [0]
ipaddr-127 0 [0]
ipv4-all 0 [0]
src-martian-addr 0 [0]
arp 1 [1]
ip6-solicited-node 1 [1]
host-group 1 [1]
router-group 1 [1]
ND 1 [1]
trill-oam 1 [1]
lldp 2 [2]
dot1x 2 [2]
dhcp 5 [2]
dhcpv6 2 [2]
http 2 [2]
svi-ip 2 [2]
pim 3 [3]
pim6 3 [3]
igmp-dvmrp 3 [3]
ip6-interface-multicast 3 [3]
ike 3 [3]
ntp 3 [3]
mld 3 [3]
rsvp 4 [4]
ospf 4 [4]
ospfv3 4 [4]
irmp 4 [4]
rip 4 [4]
ripng 4 [4]
is-is 4 [4]
bgp 4 [4]
ldp 4 [4]
mlag-pts 4 [4]
mlag-keep-alive 4 [4]
mvst 5 [5]
l2-interface-unicast 5 [5]
gvrp 5 [5]
mvst-inspection 5 [5]
ulfd 5 [5]
l2pt 5 [5]
svi-icmp 5 [5]
ethernet-cfm 5 [5]
ethernet-lmi 5 [5]
bfd 6 [6]
vbrp 6 [6]
vrrp 6 [6]
vrrp3 6 [6]
telnet 6 [6]
ssh 6 [6]
loopback-detect 6 [6]
slow-protocols 6 [6]
stp-bpdu 6 [6]
radius 6 [6]
trill 6 [6]
mlag 6 [6]
eips 7 [7]
ulpp 7 [7]
mad-fast-hello 7 [7]
erps 7 [7]
Device#
You can see that the CPU queue of SVI-IP on Device is adjusted from the default queue 2 to queue 5.
#View the rate limitation of the queue on Device.
Device#show cpu-packet pps
CoS Current-PPS [Default-PPS]
0 200 [200]
1 50 [250]
2 500 [500]
3 600 [600]
4 1000 [1000]
5 400 [400]
6 300 [300]
7 100 [100]
TOTAL 2000 [2000]
You can see that the limited queue 1 rate of ARP on device is modified from the default 250pps to 50pps.