Road to CCNP: Day 109 (CoPP/Automation)

5.2 Configure and verify infrastructure security features

                              5.2.a     ACLs

ACLs are processed top-down

ACL effectively ends with:

deny ip any any

even though you don’t see it.

Can use wildcard masks

eq = equal
neq = not equal
lt = less than
gt = greater than
range = range of ports

                              5.2.b    CoPP

ACL - identifies specific traffic
 ↓
class-map - matches that traffic into a QoS class
 ↓
policy-map - define what to do with matching traffic
 ↓
control-plane - enter control-plane config
 ↓
service-policy input -  apply this QoS policy to traffic entering the router’s control plane/CPU

ip access-list extended SSH-TRAFFIC
 permit tcp any any eq 22
class-map match-all SSH-CLASS
 match access-group name SSH-TRAFFIC
policy-map COPP-POLICY
 class SSH-CLASS
  police 64000 conform-action transmit exceed-action drop
control-plane
 service-policy input COPP-POLICY

Verification of CoPP commands

R1# show policy-map control-plane input

APIs

Northbound vs Southbound

Controller is in the middle

Northbound – lives on the controller, information is conveyed to the network management applications “north-bound”

Southbound- also lives on the controller, when management configuration is pushed from the Controller to the devices, that is Southbound traffic

RESTful APIs

An API that uses REST is often referred to a RESTful API. RESTful APIs use HTTP methods to gather and manipulate data.

6.3 Describe the high-level principles and benefits of a data modeling language, such as YANG

Yet Another Next Generation (YANG)= Data models are used

to describe whatever can be configured on a device, everything that can be monitored on a device, and all the administrative actions that can be executed on a device, such as resetting counters or rebooting the device. This includes all the notifications that the device is capable of generating. All these variables can be represented within a YANG model.

• list = the name of something with multiple instances/items
  • key = uniquely name of the item in the list
• leaf = single data field of the item in list
  • type = allowed data type
  • enumeration = value must come from predefined choices
  • config false = read-only/state data, not configurable

6.5 Interpret REST API response codes and results in payload using Cisco Catalyst Center and RESTCONF

HTTP Status Codes

2xx = okay

4xx = client messed up

5xx = server messed up