The port mirroring feature is available on Layer 2 Ethernet interfaces and Layer 3 Ethernet interfaces. The term "interface" in this chapter collectively refers to these types of interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN Switching Configuration Guide).

Overview

Port mirroring copies the packets passing through a port to the monitor port connecting to a data monitoring device for packet analysis.

Terminology

The following terms are used in port mirroring configuration.

Mirroring source

The mirroring sources can be one or more monitored ports, which are called source ports. Packets passing through mirroring sources are copied to a port connecting to a data monitoring device for packet analysis. The copies are called mirrored packets.

Source device

The device where the mirroring sources reside is called a source device.

Mirroring destination

The mirroring destination connects to a data monitoring device and is the destination port (also known as the monitor port) of mirrored packets. Mirrored packets are sent out of the monitor port to the data monitoring device.

A monitor port might receive multiple copies of a packet when it monitors multiple mirroring sources. For example, two copies of a packet are received on Port 1 when the following conditions exist:

· Port 1 is monitoring bidirectional traffic of Port 2 and Port 3 on the same device.

· The packet travels from Port 2 to Port 3.

Destination device

The device where the monitor port resides is called the destination device.

Mirroring direction

The mirroring direction specifies the direction of the traffic that is copied on a mirroring source.

· Inbound—Copies packets received.

· Outbound—Copies packets sent.

· Bidirectional—Copies packets received and sent.

Mirroring group

Port mirroring is implemented through mirroring groups, which include local, remote source, and remote destination groups. For more information about the mirroring groups, see "Port mirroring classification and implementation."

Reflector port, egress port, and remote probe VLAN

Reflector ports, remote probe VLANs, and egress ports are used for Layer 2 remote port mirroring. The remote probe VLAN specially transmits mirrored packets to the destination device. Both the reflector port and egress port reside on a source device and send mirrored packets to the remote probe VLAN. For more information about the reflector port, egress port, remote probe VLAN, and Layer 2 remote port mirroring, see "Port mirroring classification and implementation."

NOTE:

On port mirroring devices, all ports except source, destination, reflector, and egress ports are called common ports.

Port mirroring classification and implementation

Port mirroring includes local port mirroring and remote port mirroring.

· Local port mirroring—The mirroring sources and the mirroring destination are on the same device.

· Remote port mirroring—The mirroring sources and the mirroring destination are on different devices.

Local port mirroring

In local port mirroring, the following conditions exist:

· The source device is directly connected to a data monitoring device.

· The source device acts as the destination device to forward mirrored packets to the data monitoring device.

A local mirroring group is a mirroring group that contains the mirroring source and the mirroring destination on the same device.

Figure 1 Local port mirroring implementation

As shown in Figure 1, the source port FortyGigE 1/1/1 and the monitor port FortyGigE 1/1/2 reside on the same device. Packets received on FortyGigE 1/1/1 are copied to FortyGigE 1/1/2. FortyGigE 1/1/2 then forwards the packets to the data monitoring device for analysis.

Remote port mirroring

In remote port mirroring, the following conditions exist:

· The source device is not directly connected to a data monitoring device.

· The source device copies mirrored packets to the destination device, which forwards them to the data monitoring device.

· The mirroring sources and the mirroring destination reside on different devices and are in different mirroring groups.

A remote source group or remote destination group is a mirroring group that contains the mirroring sources or the mirroring destination, respectively. Intermediate devices are the devices between the source devices and the destination device.

Remote port mirroring includes the following types:

· Layer 2 remote port mirroring—The mirroring source and the mirroring destination are located on different devices on a same Layer 2 network.

· Layer 3 remote port mirroring—The mirroring source and the mirroring destination are separated by IP networks.

· Layer 2 remote port mirroring

The source device copies packets received on the source port to the egress port. The egress port forwards the packets to the intermediate devices. The intermediate devices then flood the packets in the remote probe VLAN and transmit the mirrored packets to the destination device. Upon receiving the mirrored packets, the destination device determines whether the ID of the mirrored packets is the same as the remote probe VLAN ID. If the two VLAN IDs match, the device forwards the mirrored packets to the data monitoring device through the monitor port.

Figure 2 Layer 2 remote port mirroring implementation

To ensure Layer 2 forwarding of the mirrored packets, assign the intermediate devices' ports facing the source and destination devices to the remote probe VLAN.

To monitor the bidirectional traffic of a port in a mirroring group, disable MAC address learning for the remote probe VLAN on the source, intermediate, and destination devices. For more information about MAC address learning, see Layer 2—LAN Switching Configuration Guide.

· Layer 3 remote port mirroring

Layer 3 remote port mirroring is implemented through creating a local mirroring group on both the source device and the destination device.

Layer 3 remote port mirroring works in the following flow:

a. The source device sends one copy of a packet received on the source port FortyGigE 1/1/1 to the tunnel interface.

The tunnel interface acts as the monitor port in the local mirroring group created on the source device.

b. The tunnel interface on the source device forwards the mirrored packet to the tunnel interface on the destination device through the GRE tunnel.

c. The destination device receives the mirrored packet from the physical interface of the tunnel interface.

The tunnel interface acts as the source port in the local mirroring group created on the destination device.

d. The physical interface of the tunnel interface sends one copy of the packet to the monitor port FortyGigE 1/1/2.

e. FortyGigE 1/1/2 forwards the packet to the data monitoring device.

For more information about GRE tunnels and tunnel interfaces, see Layer 3—IP Services Configuration Guide.

Figure 3 Layer 3 remote port mirroring implementation

Configuring local port mirroring

A local mirroring group takes effect only when you configure the source ports and the monitor port for the local mirroring group.

Local port mirroring configuration task list

Tasks at a glance
1. (Required.) Creating a local mirroring group
2. (Required.) Configuring source ports for the local mirroring group
3. (Required.) Configuring the monitor port for the local mirroring group

Creating a local mirroring group

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a local mirroring group.	mirroring-group group-id local	By default, no local mirroring group exists.

Configuring source ports for the local mirroring group

To configure source ports for a local mirroring group, use one of the following methods:

· Assign a list of source ports to the mirroring group in system view.

· Assign a port to the mirroring group as a source port in interface view.

To assign multiple ports to the mirroring group as source ports in interface view, repeat the operation.

Configuration restrictions and guidelines

When you configure source ports for a local mirroring group, follow these restrictions and guidelines:

· A mirroring group can contain multiple source ports.

· A port can act as a source port for multiple mirroring groups.

· A source port cannot be used as a reflector port, egress port, or monitor port.

· When you configure a TRILL access port as a source port, only non-TRILL-encapsulated packets can be mirrored. Other packets are dropped.

· When you configure a TRILL trunk port as a source port, only TRILL-encapsulated packets can be mirrored. Other packets are dropped.

· When you configure a TRILL hybrid port as a source port, both TRILL-encapsulated and non-TRILL-encapsulated packets can be mirrored.

Configuring source ports in system view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure source ports for the specified local mirroring group.	mirroring-group group-id mirroring-port interface-list { both \| inbound \| outbound }	By default, no source port is configured for a local mirroring group.

Configuring source ports in interface view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	interface interface-type interface-number	N/A
3. Configure the port as a source port for the specified local mirroring group.	mirroring-group group-id mirroring-port { both \| inbound \| outbound }	By default, a port does not act as a source port for any local mirroring group.

Configuring the monitor port for the local mirroring group

To configure the monitor port for a mirroring group, use one of the following methods:

· Configure the monitor port for the mirroring group in system view.

· Assign a port to the mirroring group as the monitor port in interface view.

Configuration restrictions and guidelines

When you configure the monitor port for a local mirroring group, follow these restrictions and guidelines:

· Do not enable the spanning tree feature on the monitor port.

· For a Layer 2 aggregate interface configured as the monitor port, do not configure its member ports as source ports.

· A mirroring group contains only one monitor port.

· Use a monitor port only for port mirroring, so the data monitoring device receives only the mirrored traffic.

Configuring the monitor port in system view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure the monitor port for the specified local mirroring group.	mirroring-group group-id monitor-port interface-type interface-number	By default, no monitor port is configured for a local mirroring group.

Configuring the monitor port in interface view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	interface interface-type interface-number	N/A
3. Configure the port as the monitor port for the specified mirroring group.	mirroring-group group-id monitor-port	By default, a port does not act as the monitor port for any local mirroring group.

Configure local port mirroring with multiple monitor ports

Typically, you can configure only one monitor port in a local mirroring group. To configure local port mirroring to support multiple monitor ports, use the remote probe VLAN.

In Layer 2 remote port mirroring, mirrored packets are broadcast within the remote probe VLAN.

To broadcast mirrored packets to multiple local monitor ports through the remote probe VLAN, perform the following tasks:

1. Create a remote source group on the local device.

2. Specify the reflector port for this mirroring group.

3. Configure the remote probe VLAN for this mirroring group.

4. Assign the local monitor ports to the remote probe VLAN.

Configuration restrictions and guidelines

When you configure local port mirroring with multiple monitor ports, follow these restrictions and guidelines:

· Configure an unused port on the device as the reflector port. Do not connect a network cable to the reflector port.

· When a port is configured as a reflector port, the port restores to the factory default settings. Do not configure other features on the reflector port.

· A mirroring group can contain multiple source ports.

· For correct operation of port mirroring, do not assign a source port to the remote probe VLAN.

· If you have configured a reflector port for a remote source group, do not configure an egress port for it.

· A VLAN can act as the remote probe VLAN for only one remote source group. H3C recommends that you use the remote probe VLAN for port mirroring exclusively. Do not create a VLAN interface or perform other configurations for the VLAN.

· A remote probe VLAN must be a static VLAN. To delete this static VLAN, first remove the remote probe VLAN configuration by using the undo mirroring-group remote-probe vlan command.

· If the remote probe VLAN of a remote mirroring group is removed, the remote mirroring group will become invalid.

Configuration procedure

To configure local port mirroring with multiple monitor ports:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a remote source group.	mirroring-group group-id remote-source	By default, no mirroring groups exist on a device.
3. Configure source ports for the remote source group.	· In system view: mirroring-group group-id mirroring-port mirroring-port-list { both \| inbound \| outbound } · In interface view: a. Enter interface view: interface interface-type interface-number b. Assign the port to the mirroring group as a source port: mirroring-group group-id mirroring-port { both \| inbound \| outbound } c. Return to system view: quit	By default, no source port is configured for a mirroring group.
4. Configure the reflector port for the remote source group.	mirroring-group group-id reflector-port reflector-port	By default, no reflector port is configured for a mirroring group.
5. Create a VLAN to be configured as the remote probe VLAN.	vlan vlan-id	By default, only VLAN 1 (system default VLAN) exists.
6. Assign monitor ports to the VLAN.	port interface-list	By default, all ports are in VLAN 1.
7. Return to system view.	quit	N/A
8. Configure the VLAN above as the remote probe VLAN for the remote source group.	mirroring-group group-id remote-probe vlan rprobe-vlan-id	By default, no remote probe VLAN is configured for a mirroring group.

Configuring Layer 2 remote port mirroring

To configure Layer 2 remote port mirroring, perform the following tasks:

· Configure a remote source group on the source device.

· Configure a cooperating remote destination group on the destination device.

· If intermediate devices exist, configure the following devices and ports to allow the remote probe VLAN to pass through.

¡ Intermediate devices.

¡ Ports connected to the intermediate devices on the source and destinations devices.

When you configure Layer 2 remote port mirroring, follow these guidelines:

· For a mirrored packet to successfully arrive at the remote destination device, make sure its VLAN ID is not removed or changed.

· Layer 2 remote port mirroring does not support using Layer 2 aggregate interfaces as source ports or monitor ports.

· Do not enable MVRP on the devices or ports that allow the remote probe VLAN to pass through. If MVRP is enabled, MVRP might register the remote probe VLAN with unexpected ports, resulting in undesired copies. For more information about MVRP, see Layer 2—LAN Switching Configuration Guide.

· H3C recommends that you configure devices in the order of the destination device, the intermediate devices, and the source device.

Tasks at a glance
(Required.) Configuring a remote destination group on the destination device: 1. Creating a remote destination group 2. Configuring the monitor port for a remote destination group 3. Configuring the remote probe VLAN for a remote destination group 4. Assigning the monitor port to the remote probe VLAN
(Required.) Configuring a remote source group on the source device: 1. Creating a remote source group 2. Configuring source ports for a remote source group 3. Configuring the egress port for a remote source group 4. Configuring the remote probe VLAN for a remote source group

Tasks at a glance

(Required.) Configuring a remote destination group on the destination device:

1. Creating a remote destination group

2. Configuring the monitor port for a remote destination group

3. Configuring the remote probe VLAN for a remote destination group

4. Assigning the monitor port to the remote probe VLAN

(Required.) Configuring a remote source group on the source device:

1. Creating a remote source group

2. Configuring source ports for a remote source group

3. Configuring the egress port for a remote source group

4. Configuring the remote probe VLAN for a remote source group

Configuring a remote destination group on the destination device

Creating a remote destination group

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a remote destination group.	mirroring-group group-id remote-destination	By default, no remote destination group exists on a device.

Configuring the monitor port for a remote destination group

To configure the monitor port for a mirroring group, use one of the following methods:

· Configure the monitor port for the mirroring group in system view.

· Assign a port to the mirroring group as the monitor port in interface view.

When you configure the monitor port for a remote destination group, follow these restrictions and guidelines:

· Do not enable the spanning tree feature on the monitor port.

· Use a monitor port only for port mirroring, so the data monitoring device receives only the mirrored traffic.

· A mirroring group must contain only one monitor port.

· A monitor port can belong to only one mirroring group.

Configuring the monitor port for a remote destination group in system view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure the monitor port for the specified remote destination group.	mirroring-group group-id monitor-port interface-type interface-number	By default, no monitor port is configured for a remote destination group.

Configuring the monitor port for a remote destination group in interface view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	interface interface-type interface-number	N/A
3. Configure the port as the monitor port for the specified remote destination group.	mirroring-group group-id monitor-port	By default, a port does not act as the monitor port for any remote destination group.

Configuring the remote probe VLAN for a remote destination group

When you configure the remote probe VLAN for a remote destination group, follow these restrictions and guidelines:

· Only an existing static VLAN can be configured as a remote probe VLAN.

· When a VLAN is configured as a remote probe VLAN, use the remote probe VLAN for port mirroring exclusively.

· Configure the same remote probe VLAN for the remote groups on the source and destination devices.

To configure the remote probe VLAN for a remote destination group:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure the remote probe VLAN for the specified remote destination group.	mirroring-group group-id remote-probe vlan vlan-id	By default, no remote probe VLAN is configured for a remote destination group.

Assigning the monitor port to the remote probe VLAN

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter the interface view of the monitor port.	interface interface-type interface-number	N/A
3. Assign the port to the remote probe VLAN.	· For an access port: port access vlan vlan-id · For a trunk port: port trunk permit vlan vlan-id · For a hybrid port: port hybrid vlan vlan-id { tagged \| untagged }	For more information about the port access vlan, port trunk permit vlan, and port hybrid vlan commands, see Layer 2—LAN Switching Command Reference.

Configuring a remote source group on the source device

Creating a remote source group

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a remote source group.	mirroring-group group-id remote-source	By default, no remote source group exists on a device.

Configuring source ports for a remote source group

To configure source ports for a mirroring group, use one of the following methods:

· Assign a list of source ports to the mirroring group in system view.

· Assign a port to the mirroring group as a source port in interface view.

To assign multiple ports to the remote source group as source ports in interface view, repeat the operation.

When you configure source ports for a remote source group, follow these restrictions and guidelines:

· Do not assign a source port of a remote source group to the remote probe VLAN of the remote source group.

· A mirroring group can contain multiple source ports.

· A port can act as a source port for multiple mirroring groups.

· A source port cannot be used as a reflector port, monitor port, or egress port.

· When you configure a TRILL access port as a source port, only non-TRILL-encapsulated packets can be mirrored. Other packets are dropped.

· When you configure a TRILL trunk port as a source port, only TRILL-encapsulated packets can be mirrored. Other packets are dropped.

· When you configure a TRILL hybrid port as a source port, both TRILL-encapsulated and non-TRILL-encapsulated packets can be mirrored.

Configuring source ports for a remote source group in system view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure source ports for the specified remote source group.	mirroring-group group-id mirroring-port interface-list { both \| inbound \| outbound }	By default, no source port is configured for a remote source group.

Configuring a source port for a remote source group in interface view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	interface interface-type interface-number	N/A
3. Configure the port as a source port for the specified remote source group.	mirroring-group group-id mirroring-port { both \| inbound \| outbound }	By default, a port does not act as a source port for any remote source group.

Configuring the egress port for a remote source group

To configure the egress port for a remote source group, use one of the following methods:

· Configure the egress port for the remote source group in system view.

· Assign a port to the remote source group as the egress port in interface view.

When you configure the egress port for a remote source group, follow these guidelines:

· Disable the following features on the egress port:

¡ Spanning tree.

¡ 802.1X.

¡ IGMP snooping.

¡ Static ARP.

¡ MAC address learning.

· A mirroring group contains only one egress port.

· A port of an existing mirroring group cannot be configured as an egress port.

Configuring the egress port for a remote source group in system view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure the egress port for the specified remote source group.	mirroring-group group-id monitor-egress interface-type interface-number	By default, no egress port is configured for a remote source group.

Configuring the egress port for a remote source group in interface view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	interface interface-type interface-number	N/A
3. Configure the port as the egress port for the specified remote source group.	mirroring-group group-id monitor-egress	By default, a port does not act as the egress port for any remote source group.

Configuring the remote probe VLAN for a remote source group

When you configure the remote probe VLAN for a remote source group, follow these restrictions and guidelines:

· Only an existing static VLAN can be configured as a remote probe VLAN.

· When a VLAN is configured as a remote probe VLAN, use the VLAN for port mirroring exclusively.

· The remote mirroring groups on the source device and destination device must use the same remote probe VLAN.

To configure the remote probe VLAN for a remote source group:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure the remote probe VLAN for the specified remote source group.	mirroring-group group-id remote-probe vlan vlan-id	By default, no remote probe VLAN is configured for a remote source group.

Configuring Layer 3 remote port mirroring

To configure Layer 3 remote port mirroring, perform the following tasks:

· Create a local mirroring group on both the source device and the destination device.

· Configure source ports and the monitor port for each mirroring group.

The source and destination devices are connected by a tunnel. If intermediate devices exist, configure a unicast routing protocol on the intermediate devices to ensure Layer 3 interoperability between the source and destination devices.

On the source device, perform the following tasks:

· Configure the ports you want to monitor as the source ports.

· Configure the tunnel interface as the monitor port.

On the destination device, perform the following tasks:

· Configure the physical interface corresponding to the tunnel interface as the source port.

· Configure the port that connects the data monitoring device as the monitor port.

Layer 3 remote port mirroring configuration task list

Tasks at a glance
(Required.) Configuring the source device: 1. Configuring local mirroring groups 2. Configuring source ports for a local mirroring group 3. Configuring the monitor port for a local mirroring group


(Required.) Configuring the destination device: 1. Configuring local mirroring groups 2. Configuring source ports for a local mirroring group 3. Configuring the monitor port for a local mirroring group

Configuration prerequisites

Before configuring Layer 3 remote mirroring, complete the following tasks:

· Create a tunnel interface and a GRE tunnel.

· Configure the source and destination addresses of the tunnel interface as the IP addresses of the physical interfaces on the source and destination devices, respectively.

For more information about tunnel interfaces, see Layer 3—IP Services Configuration Guide.

Configuring local mirroring groups

Configure a local mirroring group on both the source device and the destination device.

To create a local mirroring group:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a local mirroring group.	mirroring-group group-id local	By default, no local mirroring group exists on a device.

Configuring source ports for a local mirroring group

On the source device, configure the ports you want to monitor as the source ports. On the destination device, configure the physical interface corresponding to the tunnel interface as the source port.

To configure source ports for a mirroring group, use one of the following methods:

· Assign a list of source ports to the mirroring group in system view.

· Assign a port to the mirroring group as a source port in interface view.

To assign multiple ports to the mirroring group as source ports in interface view, repeat the operation.

Configuration restrictions and guidelines

When you configure source ports for a local mirroring group, follow these restrictions and guidelines:

· A mirroring group can contain multiple source ports.

· A port can act as a source port for multiple mirroring groups.

· A source port cannot be used as a reflector port, egress port, or monitor port.

· When you configure a TRILL access port as a source port, only non-TRILL-encapsulated packets can be mirrored. Other packets are dropped.

· When you configure a TRILL trunk port as a source port, only TRILL-encapsulated packets can be mirrored. Other packets are dropped.

· When you configure a TRILL hybrid port as a source port, both TRILL-encapsulated and non-TRILL-encapsulated packets can be mirrored.

Configuring source ports in system view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure source ports for the specified local mirroring group.	mirroring-group group-id mirroring-port interface-list { both \| inbound \| outbound }	By default, no source port is configured for a local mirroring group.

Configuring source ports in interface view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	interface interface-type interface-number	N/A
3. Configure the port as a source port for the specified local mirroring group.	mirroring-group group-id mirroring-port { both \| inbound \| outbound }	By default, a port does not act as a source port for any local mirroring group.

Configuring the monitor port for a local mirroring group

On the source device, configure the tunnel interface as the monitor port. On the destination device, configure the port that connects a data monitoring device as the monitor port.

To configure the monitor port for a mirroring group, use one of the following methods:

· Configure the monitor port for the mirroring group in system view.

· Assign a port to the mirroring group as the monitor port in interface view.

Configuration restrictions and guidelines

When you configure the monitor port for a local mirroring group, follow these restrictions and guidelines:

· A mirroring group contains only one monitor port.

· Do not enable the spanning tree feature on the monitor port.

· Use a monitor port only for port mirroring, so the data monitoring device receives only the mirrored traffic.

Configuring the monitor port in system view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure the monitor port for the specified local mirroring group.	mirroring-group group-id monitor-port interface-type interface-number	By default, no monitor port is configured for a local mirroring group.

Configure the monitor port in interface view

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	interface interface-type interface-number	N/A
3. Configure the port as the monitor port for the specified local mirroring group.	mirroring-group group-id monitor-port	By default, a port does not act as the monitor port for any local mirroring group.

Displaying and maintaining port mirroring

Execute display commands in any view.

Task	Command
Display mirroring group information.	display mirroring-group { group-id \| all \| local \| remote-destination \| remote-source }

Port mirroring configuration examples

Local port mirroring configuration example

Network requirements

As shown in Figure 4, configure local port mirroring so the server can monitor the bidirectional traffic of the Marketing department and the Technical department.

Figure 4 Network diagram

Configuration procedure

# Create local mirroring group 1.

<Device> system-view

[Device] mirroring-group 1 local

# Configure FortyGigE 1/1/1 and FortyGigE 1/1/2 as source ports for local mirroring group 1.

[Device] mirroring-group 1 mirroring-port fortygige 1/1/1 fortygige 1/1/2 both

# Configure FortyGigE 1/1/3 as the monitor port for local mirroring group 1.

[Device] mirroring-group 1 monitor-port fortygige 1/1/3

# Disable the spanning tree feature on the monitor port FortyGigE 1/1/3.

[Device] interface fortygige 1/1/3

[Device-FortyGigE1/1/3] undo stp enable

[Device-FortyGigE1/1/3] quit

Verifying the configuration

# Display information about all mirroring groups.

[Device] display mirroring-group all

Mirroring group 1:

Type: Local

Status: Active

Mirroring port:

FortyGigE1/1/1 Both

FortyGigE1/1/2 Both

Monitor port: FortyGigE1/1/3

The output shows that you can monitor all packets received and sent by the Marketing department and the Technical department on the server.

Layer 2 remote port mirroring configuration example

Network requirements

As shown in Figure 5, configure Layer 2 remote port mirroring so the server can monitor the bidirectional traffic of the Marketing department.

Figure 5 Network diagram

Configuration procedure

1. Configure Device C (the destination device):

# Configure FortyGigE 1/1/1 as a trunk port to permit the packets from VLAN 2 to pass through.

<DeviceC> system-view

[DeviceC] interface fortygige 1/1/1

[DeviceC-FortyGigE1/1/1] port link-type trunk

[DeviceC-FortyGigE1/1/1] port trunk permit vlan 2

[DeviceC-FortyGigE1/1/1] quit

# Create a remote destination group.

[DeviceC] mirroring-group 2 remote-destination

# Create VLAN 2.

[DeviceC] vlan 2

# Disable MAC address learning for VLAN 2.

[DeviceC-vlan2] undo mac-address mac-learning enable

[DeviceC-vlan2] quit

# Configure VLAN 2 as the remote probe VLAN and FortyGigE 1/1/2 as the monitor port of the mirroring group.

[DeviceC] mirroring-group 2 remote-probe vlan 2

[DeviceC] interface fortygige 1/1/2

[DeviceC-FortyGigE1/1/2] mirroring-group 2 monitor-port

# Disable the spanning tree feature on FortyGigE 1/1/2.

[DeviceC-FortyGigE1/1/2] undo stp enable

# Assign FortyGigE 1/1/2 to VLAN 2 as an access port.

[DeviceC-FortyGigE1/1/2] port access vlan 2

[DeviceC-FortyGigE1/1/2] quit

2. Configure Device B (the intermediate device):

# Create VLAN 2.

<DeviceB> system-view

[DeviceB] vlan 2

# Disable MAC address learning for VLAN 2.

[DeviceB-vlan2] undo mac-address mac-learning enable

[DeviceB-vlan2] quit

# Configure FortyGigE 1/1/1 as a trunk port to permit the packets from VLAN 2 to pass through.

[DeviceB] interface fortygige 1/1/1

[DeviceB-FortyGigE1/1/1] port link-type trunk

[DeviceB-FortyGigE1/1/1] port trunk permit vlan 2

[DeviceB-FortyGigE1/1/1] quit

# Configure FortyGigE 1/1/2 as a trunk port to permit the packets from VLAN 2 to pass through.

[DeviceB] interface fortygige 1/1/2

[DeviceB-FortyGigE1/1/2] port link-type trunk

[DeviceB-FortyGigE1/1/2] port trunk permit vlan 2

[DeviceB-FortyGigE1/1/2] quit

3. Configure Device A (the source device):

# Create a remote source group.

<DeviceA> system-view

[DeviceA] mirroring-group 1 remote-source

# Create VLAN 2.

[DeviceA] vlan 2

# Disable MAC address learning for VLAN 2.

[DeviceA-vlan2] undo mac-address mac-learning enable

[DeviceA-vlan2] quit

# Configure VLAN 2 as the remote probe VLAN of the mirroring group.

[DeviceA] mirroring-group 1 remote-probe vlan 2

# Configure FortyGigE 1/1/1 as a source port and FortyGigE 1/1/2 as the egress port in the mirroring group.

[DeviceA] mirroring-group 1 mirroring-port fortygige 1/1/1 both

[DeviceA] mirroring-group 1 monitor-egress fortygige 1/1/2

# Configure FortyGigE 1/1/2 as a trunk port to permit the packets from VLAN 2 to pass through.

[DeviceA] interface fortygige 1/1/2

[DeviceA-FortyGigE1/1/2] port link-type trunk

[DeviceA-FortyGigE1/1/2] port trunk permit vlan 2

# Disable the spanning tree feature on FortyGigE 1/1/2.

[DeviceA-FortyGigE1/1/2] undo stp enable

[DeviceA-FortyGigE1/1/2] quit

Verifying the configuration

# Display information about all mirroring groups on Device C.

[DeviceC] display mirroring-group all

Mirroring group 2:

Type: Remote destination

Status: Active

Monitor port: FortyGigE1/1/2

Remote probe VLAN: 2

# Display information about all mirroring groups on Device A.

[DeviceA] display mirroring-group all

Mirroring group 1:

Type: Remote source

Status: Active

Mirroring port:

FortyGigE1/1/1 Both

Monitor egress port: FortyGigE1/1/2

Remote probe VLAN: 2

The output shows that you can monitor all packets received and sent by the Marketing department on the server.

Local port mirroring with multiple monitor ports configuration example

Network requirements

As shown in Figure 6, configure port mirroring so servers A, B, and C can monitor the bidirectional traffic of the three departments.

Figure 6 Network diagram

Configuration procedure

# Create remote source group 1.

<DeviceA> system-view

[DeviceA] mirroring-group 1 remote-source

# Configure FortyGigE 1/1/1 through FortyGigE 1/1/3 as source ports of the remote source group.

[DeviceA] mirroring-group 1 mirroring-port fortygige 1/1/1 to fortygige 1/1/3 both

# Configure an unused port (FortyGigE 1/1/5, for example) of Device A as the reflector port of the remote source group.

[DeviceA] mirroring-group 1 reflector-port fortygige 1/1/5

This operation may delete all settings made on the interface. Continue? [Y/N]:y

# Create VLAN 10, and assign ports FortyGigE 1/1/11 through FortyGigE 1/1/13 to VLAN 10.

[DeviceA] vlan 10

[DeviceA-vlan10] port fortygige 1/1/11 to fortygige 1/1/13

[DeviceA-vlan10] quit

# Configure VLAN 10 as the remote probe VLAN of the remote source group.

[DeviceA] mirroring-group 1 remote-probe vlan 10

Layer 3 remote port mirroring configuration example

Network requirements

As shown in Figure 7, configure Layer 3 remote port mirroring so the server can monitor the bidirectional traffic of the Marketing department.

Figure 7 Network diagram

Configuration procedure

1. Configure IP addresses for the tunnel interfaces and related ports on the devices. (Details not shown.)

2. Configure Device A (the source device):

# Create service loopback group 1, and specify the tunnel service for the group.

<DeviceA> system-view

[DeviceA] service-loopback group 1 type tunnel

# Assign FortyGigE 1/1/3 to service loopback group 1.

[DeviceA] interface fortygige 1/1/3

[DeviceA-FortyGigE1/1/3] port service-loopback group 1

All configurations on the interface will be lost. Continue?[Y/N]:y

[DeviceA-FortyGigE1/1/3] quit

# Create tunnel interface Tunnel 0 that operates in GRE mode, and configure an IP address and subnet mask for the interface.

[DeviceA] interface tunnel 0 mode gre

[DeviceA-Tunnel0] ip address 50.1.1.1 24

# Configure source and destination IP addresses for Tunnel 0.

[DeviceA-Tunnel0] source 20.1.1.1

[DeviceA-Tunnel0] destination 30.1.1.2

[DeviceA-Tunnel0] quit

# Enable the OSPF protocol.

[DeviceA] ospf 1

[DeviceA-ospf-1] area 0

[DeviceA-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.0] network 20.1.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.0] quit

[DeviceA-ospf-1] quit

# Create local mirroring group 1.

[DeviceA] mirroring-group 1 local

# Configure FortyGigE 1/1/1 as a source port and Tunnel 0 as the monitor port of local mirroring group 1.

[DeviceA] mirroring-group 1 mirroring-port fortygige 1/1/1 both

[DeviceA] mirroring-group 1 monitor-port tunnel 0

3. On Device B (the intermediate device), enable the OSPF protocol.

<DeviceB> system-view

[DeviceB] ospf 1

[DeviceB-ospf-1] area 0

[DeviceB-ospf-1-area-0.0.0.0] network 20.1.1.0 0.0.0.255

[DeviceB-ospf-1-area-0.0.0.0] network 30.1.1.0 0.0.0.255

[DeviceB-ospf-1-area-0.0.0.0] quit

[DeviceB-ospf-1] quit

4. Configure Device C (the destination device):

# Create service loopback group 1, and specify the tunnel service for the group.

<DeviceC> system-view

[DeviceC] service-loopback group 1 type tunnel

# Assign FortyGigE 1/1/3 to service loopback group 1.

[DeviceC] interface fortygige 1/1/3

[DeviceC-FortyGigE1/1/3] port service-loopback group 1

All configurations on the interface will be lost. Continue?[Y/N]:y

[DeviceC-FortyGigE1/1/3] quit

# Create tunnel interface Tunnel 0 that operates in GRE mode, and configure an IP address and subnet mask for the interface.

[DeviceC] interface tunnel 0 mode gre

[DeviceC-Tunnel0] ip address 50.1.1.2 24

# Configure source and destination IP addresses for Tunnel 0.

[DeviceC-Tunnel0] source 30.1.1.2

[DeviceC-Tunnel0] destination 20.1.1.1

[DeviceC-Tunnel0] quit

# Enable the OSPF protocol.

[DeviceC] ospf 1

[DeviceC-ospf-1] area 0

[DeviceC-ospf-1-area-0.0.0.0] network 30.1.1.0 0.0.0.255

[DeviceC-ospf-1-area-0.0.0.0] network 40.1.1.0 0.0.0.255

[DeviceC-ospf-1-area-0.0.0.0] quit

[DeviceC-ospf-1] quit

# Create local mirroring group 1.

[DeviceC] mirroring-group 1 local

# Configure FortyGigE 1/1/1 as a source port and FortyGigE 1/1/2 as the monitor port of local mirroring group 1.

[DeviceC] mirroring-group 1 mirroring-port fortygige 1/1/1 inbound

[DeviceC] mirroring-group 1 monitor-port fortygige 1/1/2

Verifying the configuration

# Display information about all mirroring groups on Device A.

[DeviceA] display mirroring-group all

Mirroring group 1:

Type: Local

Status: Active

Mirroring port:

FortyGigE1/1/1 Both

Monitor port: Tunnel0

# Display information about all mirroring groups on Device C.

[DeviceC] display mirroring-group all

Mirroring group 1:

Type: Local

Status: Active

Mirroring port:

FortyGigE1/1/1 Inbound

Monitor port: FortyGigE1/1/2

The output shows that you can monitor all packets received and sent by the Marketing department on the server.

Configuring flow mirroring

The flow mirroring feature is available on both Layer 2 and Layer 3 Ethernet interfaces. The term "interface" in this chapter collectively refers to these two types of interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN Switching Configuration Guide).

Overview

Flow mirroring copies packets matching a class to a destination for analyzing and monitoring. It is implemented through QoS policies.

To configure flow mirroring, perform the following tasks:

· Define traffic classes and configure match criteria to classify packets to be mirrored. Flow mirroring allows you to flexibly classify packets to be analyzed by defining match criteria.

· Configure traffic behaviors to mirror the matching packets to the specified destination.

You can configure an action to mirror matching packets to one of the following destinations:

· Interface—The matching packets are copied to an interface connecting to a data monitoring device. The data monitoring device analyzes the packets received on the interface.

· CPU—The matching packets are copied to the CPU of the IRF member device where they are received. The CPU analyzes the packets or delivers them to upper layers.

For more information about QoS policies, traffic classes, and traffic behaviors, see ACL and QoS Configuration Guide.

Flow mirroring configuration task list

Tasks at a glance
(Required.) Configuring match criteria
(Required.) Configuring a traffic behavior
(Required.) Configuring a QoS policy
(Required.) Applying a QoS policy: · Applying a QoS policy to an interface · Applying a QoS policy to a VLAN · Applying a QoS policy globally · Applying a QoS policy to the control plane

For more information about the following commands except the mirror-to command, see ACL and QoS Command Reference.

Configuring match criteria

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a class and enter class view.	traffic classifier tcl-name [ operator { and \| or } ]	By default, no traffic class exists.
3. Configure match criteria.	if-match match-criteria	By default, no match criterion is configured in a traffic class.

Configuring a traffic behavior

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a traffic behavior and enter traffic behavior view.	traffic behavior behavior-name	By default, no traffic behavior exists.
3. Configure a mirroring action for the traffic behavior.	· Mirror traffic to an interface: mirror-to interface interface-type interface-number [ destination-ip destination-ip-address source-ip source-ip-address [ dscp dscp-value \| vlan vlan-id \| vrf-instance vrf-instance-name ] * ] · Mirror traffic to a CPU: mirror-to cpu	By default, no mirroring action is configured for a traffic behavior. When the destination IP address is specified for mirrored packets, the output interface of the route to the destination address does not support ECMP.
4. (Optional.) Display traffic behavior configuration.	· display traffic behavior	Available in any view.

Configuring a QoS policy

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a QoS policy and enter QoS policy view.	qos policy policy-name	By default, no QoS policy exists.
3. Associate a class with a traffic behavior in the QoS policy.	classifier tcl-name behavior behavior-name	By default, no traffic behavior is associated with a class.
4. (Optional.) Display QoS policy configuration.	display qos policy	Available in any view.

Applying a QoS policy

Applying a QoS policy to an interface

By applying a QoS policy to an interface, you can mirror the traffic in the specified direction on the interface. A policy can be applied to multiple interfaces, but in one direction (inbound or outbound) of an interface, only one policy can be applied.

To apply a QoS policy to an interface:

Step	Command
1. Enter system view.	system-view
2. Enter interface view.	interface interface-type interface-number
3. Apply a policy to the interface.	qos apply policy policy-name { inbound \| outbound }

Applying a QoS policy to a VLAN

You can apply a QoS policy to a VLAN to mirror the traffic in the specified direction on all ports in the VLAN.

To apply the QoS policy to a VLAN:

Step	Command
1. Enter system view.	system-view
2. Apply a QoS policy to a VLAN.	qos vlan-policy policy-name vlan vlan-id-list { inbound \| outbound }

Applying a QoS policy globally

You can apply a QoS policy globally to mirror the traffic in the specified direction on all ports.

To apply a QoS policy globally:

Step	Command
1. Enter system view.	system-view
2. Apply a QoS policy globally.	qos apply policy policy-name global { inbound \| outbound }

Applying a QoS policy to the control plane

You can apply a QoS policy to the control plane to mirror the traffic in the specified direction on all ports of the control plane.

To apply a QoS policy to the control plane:

Step	Command
1. Enter system view.	system-view
2. Enter control plane view.	control-plane slot slot-number
3. Apply a QoS policy to the control plane.	qos apply policy policy-name inbound

Flow mirroring configuration example

Network requirements

As shown in Figure 8, configure flow mirroring so that the server can monitor following traffic:

· All traffic that the Technical department sends to access the Internet.

· IP traffic that the Technical department sends to the Marketing department during working hours (8:00 to 18:00) on weekdays.

Figure 8 Network diagram

Configuration procedure

# Create a working hour range work, in which the working hour is from 8:00 to 18:00 on weekdays.

<DeviceA> system-view

[DeviceA] time-range work 8:00 to 18:00 working-day

# Create ACL 3000 to allow packets from the Technical department to access the Internet and to the Marketing department during working hours.

[DeviceA] acl number 3000

[DeviceA-acl-adv-3000] rule permit tcp source 192.168.2.0 0.0.0.255 destination-port eq www

[DeviceA-acl-adv-3000] rule permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 time-range work

[DeviceA-acl-adv-3000] quit

# Create traffic class tech_c, and configure the match criterion as ACL 3000.

[DeviceA] traffic classifier tech_c

[DeviceA-classifier-tech_c] if-match acl 3000

[DeviceA-classifier-tech_c] quit

# Create traffic behavior tech_b, configure the action of mirroring traffic to port FortyGigE 1/1/3.

[DeviceA] traffic behavior tech_b

[DeviceA-behavior-tech_b] mirror-to interface fortygige 1/1/3

[DeviceA-behavior-tech_b] quit

# Create QoS policy tech_p, and associate traffic class tech_c with traffic behavior tech_b in the QoS policy.

[DeviceA] qos policy tech_p

[DeviceA-qospolicy-tech_p] classifier tech_c behavior tech_b

[DeviceA-qospolicy-tech_p] quit

# Apply QoS policy tech_p to the incoming packets of FortyGigE 1/1/4.

[DeviceA] interface fortygige 1/1/4

[DeviceA-FortyGigE1/1/4] qos apply policy tech_p inbound

[DeviceA-FortyGigE1/1/4] quit

Verifying the configuration

# Verify that the server can monitor the following traffic:

· All traffic sent by the Technical department to access the Internet.

· The IP traffic that the Technical department sends to the Marketing department during working hours on weekdays.

(Details not shown.)

11 Network Management and Monitoring Configuration Guide

Configuring port mirroring

Terminology

Mirroring source

Source device

Mirroring destination

Destination device

Mirroring direction

Mirroring group

Reflector port, egress port, and remote probe VLAN

Local port mirroring

Remote port mirroring

Configuring local port mirroring

Configuration restrictions and guidelines

Configuring source ports in system view

Configuring source ports in interface view

Configuration restrictions and guidelines

Configuring the monitor port in system view

Configuring the monitor port in interface view

Configure local port mirroring with multiple monitor ports

Configuration procedure

Configuring Layer 2 remote port mirroring

Configuring the monitor port for a remote destination group in system view

Configuring the monitor port for a remote destination group in interface view

Creating a remote source group

Configuring source ports for a remote source group

Configuring source ports for a remote source group in system view

Configuring a source port for a remote source group in interface view

Configuring the egress port for a remote source group

Configuring the egress port for a remote source group in system view

Configuring the egress port for a remote source group in interface view

Configuring the remote probe VLAN for a remote source group

Configuring Layer 3 remote port mirroring

Configuration restrictions and guidelines

Configuring source ports in system view

Configuring source ports in interface view

Configuration restrictions and guidelines

Configuring the monitor port in system view

Configure the monitor port in interface view

Displaying and maintaining port mirroring

Port mirroring configuration examples

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Local port mirroring with multiple monitor ports configuration example

Network requirements

Configuration procedure

Verifying the configuration

Configuring match criteria

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us