cpu-defend

Hi Steelbule,

This design should be reasonable because the OSPF neighbor relationship has been established and the session already exists. The cpu-defend cannot cut off the running services according to the design. Only the policy is delivered to the interface board to prevent the subsequent establishment of the OSPF neighbor relationship. The first is to protect services and prevent service interruption caused by incorrect configurations. The second is to restart the OSPF process to confirm that the cpu-defend policy need to be delivered. In this way, the effect of double protection is achieved.

Similarly, if you configure the VTY ACL to restrict login, the ACL deny rule contains the IP address of your login ip, you are still occupying a VTY session. The ACL in the vty does not directly kick you out. Only when you exit the session, the ACL will restrict your next login.