The network engineering group of a large ISP needs to harden the management plane of its Cisco 9000 Series ASRs. While addressing IPv6 ICMP issues, they realized they have to limit the rate at which IPv6 ICMP error messages are sent out on the network. Which command do they need to apply?

On Cisco ASR 9000 Series routers, which run the IOS XR operating system, the rate of IPv6 ICMP error message generation is controlled using a token bucket mechanism. The ipv6 icmp error-interval global configuration command is used to configure this mechanism. The first parameter specifies the interval in milliseconds between adding tokens to the bucket, and the optional second parameter defines the maximum number of tokens the bucket can hold (the bucket size). This directly limits the rate at which the router can send IPv6 ICMP error messages, which is a key step in hardening the management and control planes against denial-of-service attacks.

A. icmp ipv6 rate-limit unreachable 1000: This command syntax is not valid for configuring general IPv6 ICMP error message rate-limiting on the Cisco IOS XR platform.
B. ipv6 rate-limit 1000: This is not a valid or complete command in IOS XR for the specific purpose of rate-limiting IPv6 ICMP error messages.
C. icmp ipv4 rate-limit unreachable 1000: This command is used for rate-limiting IPv4 ICMP messages, not IPv6 as required by the question.

1. Cisco IOS XR IP Addresses and Services Command Reference for Cisco ASR 9000 Series Routers, Release 7.3.x

Document Section: IPv6 Commands

Reference: The documentation for the ipv6 icmp error-interval command explicitly states, "To configure the interval and bucket size for IPv6 Internet Control Message Protocol (ICMP) error messages, use the ipv6 icmp error-interval command in global configuration mode." It details the syntax ipv6 icmp error-interval milliseconds [bucketsize], confirming this is the correct command for the specified platform and task.

2. Cisco IOS XR System Security Configuration Guide for Cisco ASR 9000 Series Routers, Release 7.3.x

Document Section: Control Plane Policing

Reference: While Control Plane Policing (CoPP) is the broader feature for protecting the control plane, the ipv6 icmp error-interval command is a specific, built-in mechanism for ICMPv6 rate limiting. The guide discusses the importance of rate-limiting control plane traffic, including ICMP, to prevent DoS attacks, which aligns with the question's goal of hardening the management plane. The ipv6 icmp error-interval command is a fundamental tool for this purpose.