Cisco Systems EA6500 Manual De Usuario

Unlike Security ACLs, QoS ACLs can be used to limit the rate of traffic without denying access to all 
the traffic in a flow. 

When using QoS ACLs to limit the rate of packets, note the following information:

The QoS ACL must specify the traffic flow to be rate-limited.

When adding a QoS ACL to limit the rate of packets to an interface that already has a QoS ACL 
configured, you must merge the rate-limiting ACL with the existing QoS ACL.

QoS ACLs need to be configured on all external interfaces that require protection. Use the interface 
range command to configure an ACL on multiple interfaces.

The following example shows how to use a QoS ACL to prevent a ping attack on a router. A QoS ACL is 
configured and applied on all interfaces to limit the rate of incoming ICMP echo packets.

Router# show ip ospf neighbors

Neighbor ID     Pri   State           Dead Time   Address         Interface

6.6.6.122         1   FULL/BDR        00:00:30    6.6.6.122       Vlan46

Router# show ip eigrp neighbors

IP-EIGRP neighbors for process 200

H   Address                 Interface   Hold Uptime   SRTT   RTO  Q  Seq Type

                                        (sec)         (ms)       Cnt Num

0   4.4.4.122               Vl44          11 00:06:07    4   200  0  6555   

Router#                                                             ping attack starts

Router# show proc cpu | include CPU utilization

CPU utilization for five seconds: 99%/90%; one minute: 48%; five minutes: 25%

Router#

2w0d: %OSPF-5-ADJCHG: Process 100, Nbr 6.6.6.122 on Vlan46 from FULL to DOWN, Neighbor 

Down: Dead timer expired

Router# show ip eigrp neighbors

IP-EIGRP neighbors for process 200

Router#

Router# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Router(config)# access-list 199 permit icmp any any echo 

Router(config)# class-map match-any icmp

Router(config-cmap)# match access-group  199

Router(config-cmap)# exit

Router(config)# policy-map icmp

Router(config-pmap)# class icmp

Router(config-pmap-c)# police 96000 16000 16000 conform-action transmit exceed-action drop

Router(config-pmap-c)# exit

Router(config-pmap)# exit

Router(config)# interface range g4/1 - 9 

Router(config-if-range)# service-policy input icmp                   policy applied

Router(config-if-range)# end

2w0d: %SYS-5-CONFIG_I: Configured from console by console

2w0d: %OSPF-5-ADJCHG: Process 100, Nbr 6.6.6.122 on Vlan46 from LOADING to FULL, Loading 

Done

Router# show ip eigrp neighbors

IP-EIGRP neighbors for process 200

H   Address                 Interface   Hold Uptime   SRTT   RTO  Q  Seq Type

                                        (sec)         (ms)       Cnt Num

0   4.4.4.122               Vl44          13 00:00:48    8   200  0  6565   

Router#