On Thu, 2013-06-27 at 18:36 +0200, "Rolf Hanßen" wrote: > Host A with IP x.x.x.x is connected to the Cisco and has no ARP entry > yet. If somebody from outside starts a connection to host A (TCP/UDP), > the packet is dropped, the Cisco does not learn the MAC of host A. > > I guess this happens because without an existing arp entry the packet > needs to be sent to the RP and is dropped by CoPP. > > I changed the last rule to "conform-action transmit" to allow a small > amount of any traffic. > This works but is not what we intented. > > Is there a way to match that "destination IP = connected IP without > entry in arp table" traffic ? I found no such option in the syntax.
You can use the "mls rate-limit unicast cef glean" hardware rate-limiter. Packets matched by a HWRL are not subjected to CoPP. -- Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
