A CoPP policy applied on the WAN interface for SSH causes SSH responses to stall under high utilization because SSH traffic does not match the ACL. What action resolves this?

Applying CoPP (Control Plane Policing) on the control plane interface (specifically, the control-plane interface in Cisco IOS) is the correct solution. CoPP protects the router's CPU from excessive traffic destined for the control plane, such as SSH, BGP, OSPF, and SNMP. When CoPP is applied to a physical interface like the WAN interface, it only polices traffic transiting that interface, not traffic destined for the router itself. SSH traffic terminates on the router's CPU, making the control plane the appropriate point for policing. Applying CoPP on the WAN interface inbound direction would still only affect transit traffic or traffic entering the router but not necessarily destined for its CPU. Rate-limiting SSH traffic might reduce the problem but doesn't address the fundamental misapplication of CoPP. Increasing IP precedence only marks the traffic; it doesn't solve the policing issue.