!
! SOLUTION CONFIG — CORE-1 (CoPP + Device Security)
! Blueprint: §4.1.a Control plane policing, §4.1.b AAA
!
version 17.6
service timestamps log datetime msec
service timestamps debug datetime msec
service password-encryption
no ip domain lookup
ip routing
logging buffered 64000
!
hostname CORE-1-SECURE
!
enable algorithm-type scrypt secret Lab@2024#EI
!
! AAA configuration (§4.1.b)
aaa new-model
aaa authentication login default local
aaa authentication enable default enable
aaa authorization exec default local
aaa accounting exec default start-stop local
!
username admin privilege 15 algorithm-type scrypt secret Lab@2024#EI
!
! TACACS+ server config (§4.1.b)
tacacs server TACACS-PRIMARY
 address ipv4 10.10.1.100
 key 7 Lab@TACACS#2024
 timeout 3
!
aaa group server tacacs+ TACACS-GROUP
 server name TACACS-PRIMARY
!
aaa authentication login VTY-AUTH group TACACS-GROUP local
aaa authorization exec VTY-AUTHOR group TACACS-GROUP local
!
! ACL for management plane
ip access-list extended ACL-MGMT-ALLOW
 permit tcp 10.10.0.0 0.0.255.255 any eq 22
 permit icmp 10.10.0.0 0.0.255.255 any
 permit udp any any eq 161
 deny ip any any log
!
! CoPP class maps (§4.1.a)
class-map match-any CM-CP-ROUTING
 description OSPF, BGP, LDP — must be protected
 match access-group name ACL-CP-ROUTING
!
class-map match-any CM-CP-MGMT
 description SSH, SNMP — management plane
 match access-group name ACL-CP-MGMT
!
class-map match-any CM-CP-ICMP
 description ICMP — limited rate
 match access-group name ACL-CP-ICMP
!
ip access-list extended ACL-CP-ROUTING
 permit ospf any any
 permit tcp any any eq 179
 permit tcp any eq 179 any
 permit udp any any eq 646
!
ip access-list extended ACL-CP-MGMT
 permit tcp 10.10.0.0 0.0.255.255 any eq 22
 permit udp 10.10.0.0 0.0.255.255 any eq 161
!
ip access-list extended ACL-CP-ICMP
 permit icmp any any
!
! CoPP policy map
policy-map PM-COPP
 class CM-CP-ROUTING
  ! Routing protocols get highest priority — police at 1 Mbps
  police rate 1000000 bps conform-action transmit exceed-action drop
 class CM-CP-MGMT
  police rate 128000 bps conform-action transmit exceed-action drop
 class CM-CP-ICMP
  police rate 64000 bps conform-action transmit exceed-action drop
 class class-default
  police rate 32000 bps conform-action transmit exceed-action drop
!
! Apply CoPP to control-plane
control-plane
 service-policy input PM-COPP
!
! uRPF on all external interfaces (§4.2.b.iii)
interface GigabitEthernet1
 description External link — uRPF enabled
 ip verify unicast source reachable-via rx
!
line vty 0 15
 transport input ssh
 login authentication VTY-AUTH
 authorization exec VTY-AUTHOR
 exec-timeout 10 0
!
end