[a-nsp] Has anyone made a separated COPP template for EOS?

[Drew Weaver]

Good morning.

I'm fine doing the work myself but if anyone already has a separated COPP template for EOS I would love to look at it.

I am of course talking about the default one that combines many of the service ports into single rules for some reason that I cannot fathom.

Specifically rules like 80, etc below.

Are there platform limitations to the number of lines in one of these ACLs that made it a requirement to do the default this way?

ip access-list new-control-plane-acl
        counters per-entry
        10 permit icmp any any
        20 permit ip any any tracked
        30 permit udp any any eq bfd ttl eq 255
        40 permit udp any any eq bfd-echo ttl eq 254
        50 permit udp any any eq multihop-bfd micro-bfd sbfd
        60 permit udp any eq sbfd any eq sbfd-initiator
        70 permit ospf any any
        80 permit tcp any any eq ssh telnet www snmp bgp https msdp ldp netconf-ssh gnmi
        90 permit udp any any eq bootps bootpc snmp rip ntp ldp ptp-event ptp-general
        100 permit tcp any any eq mlag ttl eq 255
        110 permit udp any any eq mlag ttl eq 255
        120 permit vrrp any any
        130 permit ahp any any
        140 permit pim any any
        150 permit igmp any any
        160 permit tcp any any range 5900 5910
        170 permit tcp any any range 50000 50100
        180 permit udp any any range 51000 51100
        190 permit tcp any any eq 3333
        200 permit tcp any any eq nat ttl eq 255
        210 permit tcp any eq bgp any
        220 permit rsvp any any
        230 permit tcp any any eq 9340
        240 permit tcp any any eq 9559
        250 permit udp any any eq 8503
        260 permit udp any any eq lsp-ping
        270 permit udp any eq lsp-ping any

ipv6 access-list new-control-plane-acl-v6
        counters per-entry
        10 permit icmpv6 any any
        20 permit ipv6 any any tracked
        30 permit udp any any eq bfd hop-limit eq 255
        40 permit udp any any eq bfd-echo hop-limit eq 254
        50 permit udp any any eq multihop-bfd micro-bfd sbfd
        60 permit udp any eq sbfd any eq sbfd-initiator
        70 permit ospf any any
        80 permit 51 any any
        90 permit 50 any any
        100 permit tcp any any eq ssh telnet www snmp bgp https netconf-ssh gnmi
        110 permit udp any any eq bootps bootpc snmp ntp ptp-event ptp-general
        120 permit tcp any any eq mlag hop-limit eq 255
        130 permit udp any any eq mlag hop-limit eq 255
        140 permit tcp any any range 5900 5910
        150 permit tcp any any range 50000 50100
        160 permit udp any any range 51000 51100
        170 permit udp any any eq dhcpv6-client dhcpv6-server
        180 permit tcp any eq bgp any
        190 permit tcp any any eq nat hop-limit eq 255
        200 permit udp any any eq nat hop-limit eq 255
        210 permit rsvp any any
        220 permit pim any any
        230 permit tcp any any eq 9340
        240 permit tcp any any eq 9559
        250 permit udp any any eq 8503
        260 permit udp any any eq lsp-ping
        270 permit udp any eq lsp-ping any

Just curious.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/arista-nsp/attachments/20260810/eed8f504/attachment.html>