Given the provided policy-map COPP-7600 configuration: policy-map COPP-7600 class COPP-CRITICAL-7600 police cir 2000000 bc 62500 conform-action transmit exceed-action transmit ! class class-default…

Infrastructure Security

Question

Given the provided policy-map COPP-7600 configuration:
policy-map COPP-7600
class COPP-CRITICAL-7600
police cir 2000000 bc 62500
conform-action transmit
exceed-action transmit
!
class class-default
police cir 2000000 bc 62500
conform-action transmit
exceed-action drop
!
class-map match-all COPP-CRITICAL-7600
match access-group name COPP-CRITICAL-7600
!
ip access-list extended COPP-CRITICAL-7600
permit ip any any eq http
permit ip any any eq https.
This configuration rate-limits HTTP & HTTPS traffic, but any BGP packets are processed in the 'class-default' where exceeded packets are dropped. What configuration changes are required to correctly handle BGP traffic and allow more packets for web services during peak traffic?

Exhibit

Explanation

Problem: The policy-map COPP-7600 only rate-limits HTTP & HTTPS traffic (based on the ACL conditions) as any BGP packets will be processed in the 'class-default', which drops exceeded BGP packets. Solution: 1. Add BGP to the ACL, with the statement "permit ip any any eq bgp". 2. Configure a higher value for CIR in the default class, as 2Mbps is too low for web traffic (http & https). These steps align with original choices C and E from the question choices.

Topics

#QoS#Control Plane Policing#Traffic Policing#ACLs

Community Discussion

No community discussion yet for this question.

Full 300-410 Practice