[c-nsp] Converting policy-map from IOS to NXOS no "conform drop"

[Drew Weaver]

Hello,

Sorry to bother you all, this should be my last question regarding NXOS.

I'm converting some CoPP configuration from IOS to NXOS.

Specifically in IOS 15 we have an explicit deny specified like this:

class-map match-all CoPP4-DROP
  match access-group name CoPP4_DROP
class CoPP4-DROP
   police 32000 1500 1500    conform-action drop     exceed-action drop
ip access-list extended CoPP4_DROP
remark CoPP entry to deny all other traffic
permit ip any any

in NXOS there does not appear to be any way to drop all traffic defined in a class entry. (i.e. conform drop)

I opened a ticket with TAC and they indicated that a bug (CSCut8113) was created for this but the developers ignored it without commenting.

Is there no need to drop traffic that isn't specifically permitted in NXOS? The TAC technician just told me that I would just have to allow the minimum amount of traffic, which seems to defeat the entire purpose.

As always thank you,
-Drew