Dropping ip fragments using control plane

Hi All,

Which is correct

*configuration 1:*

ip access-list extended fragment
permit ip any any fragments
!
class-map match-all fragment
match access-group name fragment
!
policy-map CP
class fragment
   drop
!
control-plane cef-exception

  service-policy input CP

*configuration 2:*

ip access-list extended fragment
permit ip any any fragments
!
class-map match-all fragment
match access-group name fragment
!
policy-map CP
class fragment
   drop
!
control-plane transit

  service-policy input CP

I feel this should be control-plane host

Regards

imran

Blogs and organic groups at http://www.ccie.net
Received on Sun Oct 03 2010 - 22:59:53 ART