Protocol ACL Filtering
The protocol ACL filtering enables the NX-OS swtich to filter all traffic to control plane based on the host
mac address. Protocol ACL filtering is supported on the MAC and IP ACLs and is not supported on the IPv6
ACls.
Beginning Cisco NX-OS Release 9.2(2), support to this feature is added on the following NX-OS platform
switches:
• Cisco Nexus 9300-EX
• Cisco Nexus 9300-EX
• Cisco Nexus 9500
Configuring ARP ACL Filtering for CoPP
You can configure MAC ACL filtering at egress CoPP.
Before you begin
Ensure that you have configured a control plane policy map.
SUMMARY STEPS
1.
configure terminal
2.
[
no
]
hardware access-list tcam region erg-copp size
3.
copy running-config startup-config
4.
reload
5.
configure terminal
6.
mac access-list mac-foo-1
7.
class-map type control-plane
[
match-all
|
match-any
]
class-map-name
8.
(Optional)
match access-group name access-list-name
9.
policy-map type control-plane policy-map-name
10.
class
{
class-map-name
[
insert-before class-map-name2
] |
class-default
}
11.
Enter one of the following commands:
•
police
[
cir
] {
cir-rate
[
rate-type
]}
•
police
[
cir
] {
cir-rate
[
rate-type
]} [
bc
]
burst-size
[
burst-size-type
]
•
police
[
cir
] {
cir-rate
[
rate-type
]]}
conform transmit
[
violate drop
]
12.
control-plane Dynamic mode
13.
service-policy-dynamic input policy-map-name
DETAILED STEPS
Purpose
Command or Action
Enters global configuration mode.
configure terminal
Example:
Step 1
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
481
Configuring Control Plane Policing
Protocol ACL Filtering
