350-401 Question 567
Single answerA network engineer is troubleshooting an issue where legitimate SSH traffic to a router is being dropped after the implementation of a Control Plane Policing (CoPP) policy. The CoPP policy was recently applied to protect the control plane from excessive traffic such as DDoS attacks. The engineer observes that other protocols like Telnet and SNMP are functioning as expected. Which step should the engineer take to resolve this issue?
- A
Verify that the CoPP policy's ACL permits SSH traffic on the correct TCP port.
- B
Increase the policing rate for all control plane traffic in the CoPP policy.
- C
Disable the CoPP policy temporarily to check if SSH traffic is permitted without it.
- D
Ensure that SSH is included in the class map used by the CoPP policy.
Show answer and explanation
Correct answer: A
Explanation
The observed issue is caused by SSH traffic being dropped due to a misconfigured CoPP ACL that does not explicitly permit TCP port 22 traffic. Control Plane Policing (CoPP) relies on ACLs to define what traffic should be allowed or denied. By verifying and ensuring SSH traffic is allowed in the ACL, the issue can be resolved effectively without compromising the CoPP policy's purpose.
- A. Correct.
If the CoPP ACL does not explicitly allow SSH traffic (TCP port 22), it will be dropped. Verifying and adjusting the ACL to permit SSH traffic on the correct port is the correct troubleshooting step.
- B. Incorrect.
Increasing the policing rate for all traffic is not a targeted approach to resolving the SSH-specific issue. This could also introduce vulnerabilities by allowing excessive traffic for other protocols.
- C. Incorrect.
Disabling CoPP temporarily could allow SSH traffic, but this is not a recommended or permanent solution. Additionally, this could expose the control plane to potential attacks.
- D. Incorrect.
Ensuring that SSH is included in the class map is important, but if the ACL does not permit SSH traffic explicitly, this step alone will not resolve the issue.