ASR1k - Punt-Policing in conjunction with CoPP - aggregate and inbound policy to Control-plane

[Randy]

Platform: asr1001 - asr1001-universalk9.03.10.02.S.153-3.S2-ext.bin

Goal: Drop all TTL<=1  (exceptions for eBGP, EIGRP, HSRP - since these apply in my case are working as desired)other-packets at ESP( qfp-outbound) before getting to RP are not working despite having service-policy applied-inbound to control-plane.


Result:
As evinced by traceroute working and all qfp stats reporting zero drops, obvious that the following:
policy-map PM-COPP
class CM-EBGP
class CM-HSRP
class CM-EIGRP
class CM-TTL0/1
police 8000 conform-action drop  exceed-action drop

is *not* working for CM-TTL0/1

class-map match-all CM-TTL0/1
match access-group name MATCH-TTL0/1


ip access-list extended MATCH-TTL0/1
permit ip any any ttl eq 0
permit ip any any ttl eq 1

Question:

Am I correct in my *understanding* that I need to enable in global-config:

platform punt-policer 29 10 ?
(29 is the is the id for punt-cause-name:RP handled ICMP and 10 would be the pps); and then reconfig my policy-map for class:
CM-TTL0/1

to something like "police rate 10 conform drop exceed drop?

Regards,
./Randy