CPUQueue Weights Rate (pps) Protocol5 16 300 ARP Request, NS, RS, iSCSI OPT Snooping6 16 400 ICMP, ARP Reply, NTP, Local terminated L3, NA, RA,ICMPv6 (other Than NDPand MLD)7 64 400 xSTP, FRRP, LACP,802.1x,ECFM,L2PT,TRILL, Openflow8 32 400 PVST, LLDP, GVRP, FCOE,FEFD, Trace flow9 64 600 OSPF, ISIS, RIPv2, BGP10 32 300 DHCP, VRRP11 32 300 PIM, IGMP, MSDP, MLDCatch-All Entry for IPv6 PacketsDell Networking OS currently supports configuration of IPv6 subnets greater than /64 mask length, but the agent writes it to thedefault LPM table where the key length is 64 bits. The device supports table to store up to 256 subnets of maximum of /128 masklengths. This can be enabled and agent can be modified to update the /128 table for mask lengths greater than /64. This will restrictthe subnet sizes to required optimal level which would avoid these NDP attacks. The IPv6 stack already supports handling of >/64subnets and doesn’t require any additional work. The default catch-all entry is put in the LPM table for IPv4 and IPv6. If this isincluded for IPv6, you can disable this capability by using the no ipv6 unknown-unicast command. Typically, the catch-allentry in LPM table is used for soft forwarding and generating ICMP unreachable messages to the source. If this is in place thenirrespective of whether it is /64 subnet, it doesn’t have any effect as there would always be LPM hit and traffic aresent to CPU.Unknown unicast L3 packets are terminated to the CPU CoS queue which is also shared for other types of control-plane packets likeARP Request, Multicast traffic, L3 packets with Broadcast MAC address. The catch-all route poses a risk of overloading the CPUwith unknown unicast packets. This CLI knob to turn off the catch-all route is of use in networks where the user does not want togenerate Destination Unreachable messages and have the CPU queue’s bandwidth available for higher priority control-plane traffic.Configuring CoPP for OSPFv3You can create an IPv6 ACL for control-plane traffic policing for OSPFv3, in addition to the CoPP support for VRRPv3, BGPv6, andICMPv6. This functionality is supported on the S4810, S4820T, S6000, MXL, and Z9000 platforms. You can use the ipv6access-list name cpu-qos permit ospfv3 or the ipv6 access-list name cpu-qos ospfv3 command to allowCoPP traffic for OSPFv3. The control plane management support for IPv6 ICMPv6 packets is enhanced to enable more number ofCPU queues on port to be available and other COPP improvements have been implemented.To configure control-plane policing, perform the following:1. Create an IPv6 ACL for control-plane traffic policing for ospfv3.CONFIGURATION modeDell(conf)#ipv6 access-list ospfv3 cpu-qosDell(conf-ipv6-acl-cpuqos)#permit ospf2. Create a QoS input policy for the router and assign the policing.CONFIGURATION modeDell(conf)#qos-policy-input ospfv3_rate cpu-qosControl Plane Policing (CoPP) 217
