Cisco 300-410: Quality of Service and Control-Plane Protection — Study Guide

By Laurynas Brazys · 16 August 2026 · #cisco #300-410 #certification #exam-prep #study-guide

Part of the Cisco CCNP Enterprise 300-410 ENARSI — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Quality of Service (QoS) and Control-Plane Protection (CoPP/CPPr) together ensure that business-critical applications and the network itself remain stable under load and attack. QoS differentiates traffic, prioritizes delay-sensitive flows, and manages congestion on scarce links. CoPP/CPPr shields the router CPU and management stack from accidental overload and malicious events. Correct design depends on consistent end-to-end marking, disciplined trust boundaries, appropriate conditioning (policing/shaping), well-sized queues, proactive congestion avoidance, careful treatment of tunnels/encryption, and continuous validation using counters correlated with application behavior.

Classification, Trust, and End-to-End Marking

Traffic classification and marking determine how packets will be queued and potentially dropped at each hop.

• Classification and matching

  • Match on access-lists, DSCP/IP precedence, CoS (802.1p), NBAR application signatures, or tunnel inner headers (with qos pre-classify).
  • Maintain determinism: match on Layer 3/4 fields when possible; use NBAR only where necessary due to CPU implications on some platforms.

• Trust boundaries

  • Define where the network accepts existing markings. Typical: do not trust end hosts; trust enterprise phones and uplinks to known QoS domains.
  • At the edge, remark untrusted traffic to policy-defined DSCP values; trust only devices that you manage and authenticate.
  • On switch ports toward endpoints, remove trust (no trust dscp/cos) unless you explicitly verify device type.

• Marking

  • DSCP (6 bits) is the primary end-to-end marking in IP networks. IP precedence (3 bits) is legacy and maps to the upper bits of DSCP.
  • CoS (802.1p, 3 bits) marks Layer 2 frames across VLAN trunks; map DSCP↔CoS consistently at L2/L3 boundaries.
  • In MPLS cores, the 3-bit Traffic Class (TC, formerly EXP) carries QoS; map DSCP to TC at ingress and TC back to DSCP at egress to preserve semantics across the VPN or TE core.

• Marking consistency

  • Reserve EF for voice bearer (low-jitter), CS3/AF31/AF32 for call signaling, AF4x for interactive video, AF2x/AF1x for critical data, CS0/BE for best effort, and CS1 for scavenger.
  • Document a single enterprise QoS policy; ensure WAN providers honor and map as contracted.
  • Avoid re-marking mid-path unless translating between domains; otherwise you risk priority inversion and troubleshooting complexity.

Example (ingress edge marking): class-map match-any CM-VOICE match ip dscp ef match protocol rtp audio class-map match-any CM-SIGNAL match ip dscp cs3 match tcp port 5060 ! policy-map PM-MARK-IN class CM-VOICE set dscp ef class CM-SIGNAL set dscp cs3 class class-default set dscp default ! interface GigabitEthernet0/1 service-policy input PM-MARK-IN

Failure modes and trade-offs:

• Trusting the wrong edge leads to priority abuse; low-value flows can starve critical queues.
• Inconsistent DSCP↔CoS mappings break QoS at L2/L3 transitions.
• Excessive NBAR use on software platforms may elevate CPU; prefer static matches.

Conditioning, Queuing, and Congestion Avoidance

Traffic conditioning shapes traffic to rates the network can sustain and applies policing where hard limits are required.

• Policing vs. shaping

  • Policing enforces a rate using token buckets; excess is dropped or optionally remarked. It preserves link capacity but increases loss and can trigger TCP backoff and application retries.
  • Shaping buffers and releases at a target rate (typically to a carrier CIR) smoothing bursts and reducing downstream drops; it adds delay and jitter proportional to queue depth.

• Burst parameters

  • Single-rate two-parameter policers use committed information rate (CIR) with committed burst (Bc) and optionally Be (excess burst).
  • Too-small Bc relative to RTT and MTU causes fragmentation-level drops and ineffective throughput; size Bc to at least 1–2 x bandwidth-delay product for shaping, and several MTUs for policing.

• CBWFQ and LLQ

  • Class-Based Weighted Fair Queuing guarantees minimum bandwidth to classes. Configure bandwidth in kbps or percent under shape.
  • Low-Latency Queue (LLQ) adds strict-priority servicing to a class (priority), policed at the configured rate to prevent starvation. Only real-time voice/video bearer should be in LLQ.
  • Queue limits (queue-limit) set the maximum packets buffered per class; too high increases latency, too low increases drop. Balance with application tolerance.

• WRED vs. tail drop

  • Tail drop discards only when queues are full; this can cause global TCP synchronization and large oscillations.
  • Weighted Random Early Detection (WRED) begins probabilistic drops before full; DSCP-based WRED lets higher priority classes tolerate deeper queues with lower early-drop probability.
  • WRED benefits TCP flows; for predominantly UDP (voice) it adds loss without backoff. Do not enable WRED in LLQ.

Example (parent shaping with child CBWFQ/LLQ and WRED): policy-map PM-WAN-CHILD class CM-VOICE priority percent 10 set dscp ef class CM-VIDEO bandwidth percent 20 queue-limit 300 random-detect dscp-based class CM-CRITICAL bandwidth percent 15 random-detect dscp-based class class-default fair-queue random-detect ! policy-map PM-WAN-PARENT class class-default shape average 10000000 service-policy PM-WAN-CHILD ! interface Serial0/0/0 service-policy output PM-WAN-PARENT

Key design points:

• Always shape to the lowest downstream bottleneck you control; let your queuing decide, not the provider’s dropper.
• Size LLQ based on codec and call volume; include 5–10% overhead for headers and VAD variability.
• Enable WRED only where multiplexed TCP flows dominate; tune weights conservatively to prevent premature drops.

QoS on Tunnels and WAN Links

Tunnels and encryption obscure inner headers and change MTU, affecting classification and fragmentation.

• GRE/DMVPN and IPsec

  • Without special handling, classification sees only outer headers. Use qos pre-classify on tunnel interfaces so the device classifies on the inner 5-tuple and DSCP before encapsulation/encryption.
  • Preserve or copy DSCP to the outer header to maintain network QoS behavior across transit.
  • Adjust MTU and MSS to avoid fragmentation and PMTUD failures; for IPsec, fragmentation after-encryption may be required on certain platforms and carriers.

• Per-tunnel QoS and hierarchical design

  • On mGRE/DMVPN, apply hierarchical QoS (shape per-tunnel, then LLQ/CBWFQ per class) to ensure fair sharing among spokes.
  • When provider circuits enforce CIR with strict policers, shape at or slightly below CIR to avoid provider tail drops.

Example (DMVPN hub/spoke QoS on tunnel): interface Tunnel30 ip address 10.0.30.1 255.255.255.0 tunnel mode gre multipoint qos pre-classify ip mtu 1400 ip tcp adjust-mss 1360 service-policy output PM-WAN-PARENT ! crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac crypto ipsec profile DMVPN-PROFILE set transform-set TS ! ! Platform-dependent: crypto ipsec fragmentation after-encryption

Common pitfalls and mitigations:

• Missing qos pre-classify leads to all traffic falling into class-default after encryption, starving real-time flows.
• Incorrect MTU/MSS causes blackholing of large segments and erratic application performance; validate path MTU end-to-end.
• Applying complex policies at line rate on software tunnels can tax CPU; prefer hardware offload where available.

Control-Plane Protection (CoPP/CPPr) and Operational Validation

CoPP protects the router CPU by classifying and rate-limiting control and management traffic in the control-plane path. CPPr adds finer granularity using host, transit, and CEF-exception subinterfaces.

• CoPP fundamentals

  • Attach policies to the control-plane, not data interfaces.
  • Match types commonly supported are ip dscp, ip precedence, and access-group. Do not use the log keyword on ACL entries referenced by CoPP.
  • Separate critical routing protocols (BGP, OSPF, RSVP/LDP where applicable) from best-effort management (HTTP) and bulk control traffic (NetFlow exports to CPU in exception cases). Provide generous CIRs for critical protocols.

• CPPr detail

  • control-plane host governs traffic terminated on the router (e.g., SSH, SNMP, routing sessions).
  • control-plane transit handles exception traffic punted from hardware (e.g., TTL-exceeded, MTU exceeded).
  • control-plane cef-exception manages CEF-related punts.
  • Apply different policies per subinterface to avoid collateral damage when one class misbehaves.

• Example CoPP with exclusions and correct attachment: ip access-list extended ACL-TELNET-EXEMPT deny tcp host 10.1.1.1 any eq 23 deny tcp host 172.16.1.1 any eq 23 permit ip any any ip access-list extended ACL-BGP permit tcp any any eq 179 permit tcp any eq 179 any ip access-list extended ACL-HTTP permit tcp any any eq 80 permit tcp any any eq 443 ! class-map match-any CM-BGP match access-group name ACL-BGP class-map match-any CM-HTTP match access-group name ACL-HTTP class-map match-any CM-TELNET match access-group name ACL-TELNET-EXEMPT ! policy-map PM-COPP class CM-BGP police cir 256000 conform-action transmit exceed-action transmit class CM-HTTP police cir 64000 conform-action transmit exceed-action drop class CM-TELNET police cir 100000 conform-action transmit exceed-action drop class class-default police cir 32000 conform-action transmit exceed-action drop ! ! Ensure policy is on the control plane, and not on data interfaces: no interface GigabitEthernet0/0 service-policy input PM-COPP control-plane service-policy input PM-COPP

Notes:

• Rate-limiting BGP too aggressively can cause missed keepalives, session resets, and route churn. If you must police, set a sufficient CIR and consider exceed-action transmit to avoid drops during spikes.

• Exempt specific trusted management sources by using ACL denies before the permit; apply the ACL as a match under the relevant class.

• Management-plane complements

  • IPv6 RA Guard blocks rogue Router Advertisements on L2 ports but cannot protect when RA is tunneled; enforce at tunnel endpoints or use authentication where possible.
  • IPv6 Source Guard uses the binding table to permit only valid source addresses; it drops traffic from unknown/unallocated IPv6 sources on access ports, reducing CPU-bound exception traffic.
  • Device hardening (disable unused services, use ACLs on vty, limit SNMP communities) reduces control-plane exposure.

• Validation and counters

  • Use show policy-map interface and show policy-map control-plane to verify packet counts, drops, and police actions. First run show policy-map control-plane when CPU-bound symptoms appear (e.g., slow SSH, intermittent SNMP).
  • On hardware-forwarding platforms, correlate with show platform hardware qfp active statistics drop or equivalent ASIC counters for WRED/tail drops.
  • For queues, check queue depths, tail/WRED drops, and priority queue policing using show policy-map interface and show queueing interface.
  • Look for application symptoms:
    • Voice jitter, packet loss, or choppy audio suggests LLQ too small or wrong trust boundary.
    • Slow/disconnecting SSH but normal pings can indicate CoPP policing of management traffic.
    • Intermittent SNMP correlates with management-class drops or CEF exception punts exceeding limits.
    • TCP throughput collapse under load with rising WRED drops is expected; with tail drop only, look for synchronized sawtooth flows.

Practical Problem Scenario

Acme Engineering runs a DMVPN single-hub network over Internet broadband with IPsec+mGRE. Users report choppy VoIP to HQ, intermittent SNMP polling of branch routers, and slow or disconnecting SSH to the hub during peak hours.

1. Establish trust boundaries and remark at the edge

• Rationale: Phones and trusted uplinks are the only devices allowed to set EF/CS3; all other access traffic is remarked to BE. This prevents priority abuse that could starve real-time classes.

2. Implement hierarchical QoS on the DMVPN tunnel

• Rationale: Apply a parent shaper to the tunnel at the measured provider rate (e.g., 20 Mbps) to avoid upstream policing. Under the parent, use LLQ for EF voice, bandwidth classes for video and critical data, WRED for TCP-dominant classes, and fair-queue for default. This localizes congestion management before the carrier drops packets.

3. Enable qos pre-classify and adjust MTU/MSS

• Rationale: qos pre-classify ensures the policy matches inner IP/port/DSCP before GRE/IPsec encapsulation. ip mtu 1400 and ip tcp adjust-mss 1360 prevent fragmentation/blackholing due to encapsulation overhead. after-encryption fragmentation is set to accommodate provider behavior.

4. Remove interface-applied CoPP and attach to the control plane

• Rationale: CoPP must protect the CPU regardless of ingress interface. Detach any input service-policy from physical interfaces and apply PM-COPP to the control-plane to centrally govern punted and host-terminated traffic.

5. Create distinct CoPP classes with safe CIRs; exempt trusted sources

• Rationale: Place BGP in its own class with a CIR sufficient for keepalives and bursts; configure conform/exceed transmit to avoid session resets. Police HTTP/HTTPS to low rates to cap web management to the CPU. For Telnet/SSH exceptions, deny trusted management IPs in the ACL so the policy does not rate-limit them, while still controlling all other sources.

6. Validate and iterate based on counters and symptoms

• Rationale: Use show policy-map control-plane to confirm management drops align with observed SSH/SNMP issues; adjust CIRs until drops cease. Use show policy-map interface Tunnel30 to verify LLQ utilization and ensure no priority overflow policing occurs under normal call volume. Monitor WRED and tail drops in critical classes; if voice quality remains poor without LLQ drops, increase LLQ percent slightly; if drops occur, size LLQ and parent shaper more accurately to codec and bandwidth.

By enforcing a correct trust boundary, shaping before the bottleneck, classifying pre-encapsulation, and protecting the control plane with properly scoped CoPP/CPPr policies, Acme Engineering restores voice quality and stabilizes management access without sacrificing overall throughput.

← Multicast Routing and Distribution · All domains · VPN →

Practice these questions → · Timed practice on ExamRoll.io →