350-401 Question 548
Single answerA network administrator has implemented Control Plane Policing (CoPP) on a router to protect it from attacks such as DoS. After deploying the configuration, they notice that legitimate management traffic (e.g., SSH) is being dropped. What step should the administrator take to troubleshoot and resolve this issue?
- A
Increase the CoPP policy rate limit for the SSH traffic class.
- B
Remove the CoPP configuration to allow all traffic to pass.
- C
Use a packet sniffer on the router's interfaces to analyze incoming traffic patterns.
- D
Verify the access control list (ACL) used in the CoPP policy to ensure it matches legitimate SSH traffic.
Show answer and explanation
Correct answer: D
Explanation
Control Plane Policing (CoPP) relies on ACLs to classify traffic. If the ACL used in the CoPP policy is misconfigured, legitimate traffic such as SSH could be incorrectly dropped. The administrator should review the ACL to ensure it accurately matches the desired traffic. This is a critical troubleshooting step before considering other actions, such as adjusting rate limits, as it directly addresses the issue.
- A. Incorrect.
Increasing the CoPP rate limit may alleviate the issue temporarily but does not address the root cause of why legitimate traffic is being dropped. The rate limit should only be adjusted after verifying the ACL and other related configurations.
- B. Incorrect.
Removing the CoPP configuration is not recommended as it would leave the router vulnerable to attacks, negating the purpose of implementing router security features.
- C. Incorrect.
Using a packet sniffer can help analyze traffic patterns but does not directly identify or resolve misconfigurations within the CoPP policy itself.
- D. Correct.
Verifying the ACL ensures that the CoPP policy is correctly classifying legitimate traffic. A misconfigured ACL could falsely identify legitimate traffic as malicious, leading to drops.