← Back to Lab Index
Lab 10 §4.1 §4.2.b §4.2.c Advanced ⏱ 60 min

Device Security — CoPP, AAA & uRPF

Harden the control plane with CoPP, configure AAA with TACACS+, enable uRPF, and deploy IPv6 security features.

Network Topology
MPLS CORE + PE EDGE DMVPN WEST DMVPN EAST CUSTOMER EDGE + BORDER CORE-1 10.255.1.1 CORE-2 10.255.1.2 CORE-3 10.255.1.3 CORE-4 10.255.1.4 EDGE-1 10.255.2.1 EDGE-2 10.255.2.2 EDGE-3 10.255.2.3 EDGE-4 10.255.2.4 HUB-WC-1 172.16.10.254 HUB-WC-2 172.16.10.253 HUB-EC-1 172.16.20.254 HUB-EC-2 172.16.20.253 SPK-WC-1 .10.1 SPK-WC-2 .10.2 SPK-WC-3 .10.3 SPK-EC-1 .20.1 SPK-EC-2 .20.2 SPK-EC-3 .20.3 BORDER-1 10.255.3.1 BORDER-2 10.255.3.2 CE-CORP-1 10.255.6.1 CE-CORP-2 10.255.6.2 P Router (CORE) PE Router (EDGE) DMVPN Hub DMVPN Spoke Border (ASBR) Customer Edge (CE) AS 65000 — OSPF Area 0 — LDP

Prerequisites

Task Sheet — CCIE Exam Format

Task 1Medium
Configure AAA with TACACS+ server at 10.10.1.100. Create local fallback user 'admin'. Apply to VTY lines with exec authorization.
✓ Verify: test aaa group tacacs+ admin Lab@2024#EI legacy
Task 2Hard
Build CoPP policy: OSPF/BGP/LDP routing traffic at 1Mbps, management (SSH/SNMP) at 128Kbps, ICMP at 64Kbps, default drop at 32Kbps. Apply to control-plane.
✓ Verify: show policy-map control-plane
Task 3Hard
Enable uRPF strict mode on all external-facing interfaces (toward BORDER routers and CE routers).
✓ Verify: show ip interface GigabitEthernet2 | include verify
Task 4Hard
Configure IPv6 RA Guard on all access-facing ports to prevent rogue Router Advertisements.
✓ Verify: show ipv6 nd raguard policy
Task 5Hard
Enable IPv6 DHCP Guard on untrusted ports. Configure IPv6 binding table and device tracking.
✓ Verify: show ipv6 dhcp guard policy
Task 6Hard
Enable SNMP v3 with authPriv security level. User 'snmp-admin', auth SHA, priv AES-128.
✓ Verify: show snmp user

Key Concepts

Control Plane Policing (CoPP) protects the router's CPU from being overwhelmed by high-rate traffic destined to the control plane (routing protocol packets, management traffic, ICMP). Without CoPP, a DoS attack sending millions of pps to the CPU can make the router unresponsive. CoPP uses MQC to classify and rate-limit control-plane bound traffic.

Unicast Reverse Path Forwarding (uRPF) verifies the source IP of incoming packets has a valid return path through the interface it arrived on. In strict mode, the return path must be through the same interface — preventing IP spoofing. In loose mode, any valid route suffices. Enable strict mode on single-homed (non-multihomed) edges.

IPv6 introduces new attack vectors: Rogue Router Advertisements (RA) can redirect hosts to a malicious default gateway. RA Guard drops RAs on untrusted ports. DHCP Guard blocks DHCPv6 server messages on untrusted ports. IPv6 Source Guard validates source addresses against the binding table. These mirror the IPv4 DHCP Snooping/DAI protections.

Verification Commands

show policy-map control-plane
CoPP policy applied: all classes show conform/exceed counters
show ip interface | include verify
Strict feasible check (uRPF) enabled on external interfaces
show ipv6 nd raguard policy
Policy applied to access interfaces as 'sink' (drop RAs)
show snmp user
snmp-admin: auth SHA, priv AES128, active

Common Mistakes & Troubleshooting

CoPP dropping legitimate routing traffic

Check class-map matches for routing protocols. OSPF uses IP protocol 89, BGP uses TCP 179. If adjacencies drop after CoPP, increase police rate or check ACL in class-map. Start with conform-action transmit, exceed-action transmit while tuning.

uRPF dropping valid traffic

In asymmetric routing environments, strict uRPF drops packets arriving via non-best-path interfaces. Switch to loose mode ('ip verify unicast source reachable-via any') or add static routes to satisfy strict check.

TACACS+ authentication failing

Verify TACACS server IP, port (49), and shared key. Test with 'test aaa group tacacs+'. Check server logs. Always configure local fallback ('aaa authentication login default group tacacs+ local') to avoid lockout.

Solution Configs

Attempt the tasks yourself before viewing solutions.
Type SOLUTION to unlock.

CORE-1

! See solution-configs/CORE-1.cfg

BORDER-1

! See solution-configs/BORDER-1.cfg
Study Timer
45:00
CCIE EI v1.0 Blueprint: §4.1 §4.2.b §4.2.c  ·  ← All Labs  ·  Independent study resource. Not affiliated with Cisco Systems, Inc.
⬇ Initial Configs — Load These to Start the Lab
⬇ BORDER-1-initial.cfg ⬇ CORE-1-initial.cfg
Solution Configs — Reveal After Completing Tasks
⬇ BORDER-1.cfg ⬇ CORE-1.cfg

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.