Troubleshoot Cisco IOS CoPP Configuration for Routing and Management
SIMULATION
Guidelines
This is a lab item in which tasks will be performed on virtual devices.
• Refer to the Tasks tab to view the tasks for this lab item.
• Refer to the Topology tab to access the device console(s) and perform the tasks.
• Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.
• All necessary preconfigurations have been applied.
• Do not change the enable password or hostname for any device.
• Save your configurations to NVRAM before moving to the next item.
• Click Next at the bottom of the screen to submit this lab and move to the next question.
• When Next is clicked, the lab closes and cannot be reopened.
Topology
Tasks
A network is configured with CoPP to protect the CORE router route processor for stability and DDoS protection. As a company policy, a class named class-default is preconfigured and must not be modified or deleted. Troubleshoot CoPP to resolve the issues introduced during the maintenance window to ensure that:
1. Dynamic routing policies are under CoPP-CRITICAL and are allowed only from the 10.10.x.x range.
2. Telnet, SSH, and ping are under CoPP-IMPORTANT and are allowed strictly to/from 10.10.x.x to the CORE router (Hint: you can verify using Loopback1).
3. All devices ping (UDP) any CORE router interface successfully to/from the 10.10.x.x range and do not allow any other IP address.
4. All devices run a successful traceroute (UDP) to any interface on the CORE router to/from the 10.10.x.x range, are under CoPP-NORMAL, and do not allow any other IP address traceroute is to be under CoPP-NORMAL (Hint: Traceroute port range 33434 33464).
Community Insight
The question tests the ability to map dynamic routing protocols, management access, and diagnostic tools (ping/traceroute) into distinct CoPP tiers while strictly enforcing source IP restrictions from the 10.10.x.x range.
This simulation requires configuring Class-Based Policing (CoPP) to protect the CORE router's route processor by defining specific class-maps and policy-maps for critical, important, and normal traffic classes.
Candidates often fail to restrict the 'important' and 'normal' classes to only allow traffic destined to or originating from the CORE router itself, inadvertently allowing lateral movement between other routers in the topology.
Community Discussion (23 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The solution requires creating three distinct class-maps (COPP-CRITICAL, COPP-IMPORTANT, COPP-NORMAL) and applying them via a policy-map to the control-plane interface. COPP-CRITICAL must permit EIGRP (protocol 88) and multicast updates (224.0.0.10) from the 10.10.0.0/16 network. COPP-IMPORTANT must permit TCP 22/23 and ICMP echo from/to the CORE router's interfaces, specifically verified against Loopback1. COPP-NORMAL must permit UDP traceroute packets (ports 33434-33464) from the allowed range to any CORE interface.Why Other Candidate Answers Are Wrong
Incorrect configurations typically apply broad permits that allow traffic between non-CORE routers (e.g., PE1 to PE2), violating the 'to/from CORE router' constraint. Another common error is omitting the reverse direction (any host to 10.10.x.x) for management traffic, which prevents outbound SSH/Telnet sessions from being policed correctly. Some users also confuse the UDP ports for traceroute with standard ping (ICMP), leading to misconfigured ACLs.Community Comment Notes
As DavideDL noted, strict adherence to the 'to/from CORE' requirement means permitting traffic where one side is the CORE router's IPs. User leipeG highlighted the confusion regarding 'ping (UDP)', clarifying that task 3 refers to traceroute behavior which uses UDP, not ICMP echo. Several commenters confirmed that verifying connectivity using Loopback1 is the key validation step for the IMPORTANT class.Exam Strategy
Always read the 'to/from' constraints carefully; if it says 'to/from CORE', ensure both destination and source are restricted to CORE interfaces, not just the source. Use the provided hints (like Loopback1 IP and Traceroute port ranges) to build precise ACL entries rather than guessing wildcard masks.
Frequently Asked Questions
Why does task 3 mention 'ping (UDP)'?
It refers to traceroute, which uses UDP packets (ports 33434-33464) to discover paths, not standard ICMP ping. The task requires permitting this specific UDP range.
Do I need to permit traffic between other routers?
No. The prompt explicitly states management and diagnostic traffic must be allowed 'strictly to/from the CORE router'. Traffic between PE routers should be denied or handled by default.
Related Analysis
Practice All 300-410 Questions
Access 159 questions with complete answers and detailed explanations.
View Full 300-410 Practice Test →