Refer to the exhibit. How will Telnet packets from host 10.1.1.1 be treated by the configured CoPP policy?
!
class-map telnet-class
match access-group 100
!
policy-map telnet-policy
class telnet-class
police 80000 conform transmit exceed drop
!
control-plane
service-policy input telnet-policy
!
access-list 100 deny tcp host 10.1.1.1 any eq telnet
access-list 100 deny tcp host 10.1.1.2 any eq telnet
access-list 100 permit tcp any any eq telnet- Telnet packets from host 10.1.1.1 will be dropped by the CoPP policy.
- Telnet packets from host 10.1.1.1 will be permitted without policing.
- Telnet packets from host 10.1.1.1 will be dropped at the inbound interface.
- Telnet packets from host 10.1.1.1 will be policed to 8 kbps.
Explanation: The behavior of Control Plane Policing (CoPP) depends on how traffic is classified within the Modular QoS CLI (MQC) framework. In this scenario, the class-map telnet-class uses access-list 100 to identify traffic for policing.
In the context of CoPP classification, a "deny" statement in the referenced ACL does not mean the packet is dropped at the interface; instead, it means the packet is excluded from that specific class. According to the sources, when a packet matches a "deny" statement in the ACL, it will still be forwarded to the control plane, but it will not be policed by the actions defined in that class map.
Because the first line of access-list 100 is deny tcp host 10.1.1.1 any eq telnet, Telnet traffic from host 10.1.1.1 is explicitly excluded from the telnet-class. Consequently, these packets bypass the police 80000 command and are granted unfettered access to the device’s control plane. This configuration is typically used to ensure that trusted hosts are never restricted by rate-limiting during high-traffic events or potential attacks.
Related exam: Modules 14 – 16: Checkpoint Exam: Network Security Answers (CCNP ENCOR v9)
