11-Network Management and Monitoring Configuration Guide

HomeSupportSwitchesS12500X-AF SeriesConfigure & DeployConfiguration GuidesH3C S12500X-AF Switch Series Configuration Guides(R320x)-6W10011-Network Management and Monitoring Configuration Guide
15-Mirroring configuration
Title Size Download
15-Mirroring configuration 392.91 KB

Contents

Configuring port mirroring· 1

About port mirroring· 1

Terminology· 1

Port mirroring classification· 2

Local port mirroring· 2

Layer 2 remote port mirroring· 2

Layer 3 remote port mirroring· 4

Restrictions and guidelines: Port mirroring configuration· 5

Configuring local port mirroring· 5

Restrictions and guidelines for local port mirroring configuration· 5

Local port mirroring tasks at a glance· 5

Creating a local mirroring group· 6

Configuring mirroring sources· 6

Configuring the monitor port 7

Configuring Layer 2 remote port mirroring· 7

Restrictions and guidelines for Layer 2 remote port mirroring configuration· 7

Layer 2 remote port mirroring with reflector port configuration task list 8

Layer 2 remote port mirroring with egress port configuration task list 8

Creating a remote destination group· 9

Configuring the monitor port 9

Configuring the remote probe VLAN·· 9

Assigning the monitor port to the remote probe VLAN·· 10

Creating a remote source group· 10

Configuring mirroring sources· 10

Configuring the reflector port 12

Configuring the egress port 12

Configuring Layer 3 remote port mirroring (in tunnel mode) 13

Restrictions and guidelines for Layer 3 remote port mirroring configuration· 13

Layer 3 remote port mirroring tasks at a glance· 13

Prerequisites for Layer 3 remote port mirroring· 14

Configuring local mirroring groups· 14

Configuring mirroring sources· 14

Configuring the monitor port 15

Configuring Layer 3 remote port mirroring (in ERSPAN mode) 16

Restrictions and guidelines for Layer 3 remote port mirroring in ERSPAN mode configuration· 16

Layer 3 remote port mirroring tasks at a glance· 16

Creating a local mirroring group on the source device· 16

Configuring mirroring sources· 17

Configuring the monitor port 18

Display and maintenance commands for port mirroring· 18

Port mirroring configuration examples· 19

Example: Configuring local port mirroring (in source port mode) 19

Example: Configuring local port mirroring (in source CPU mode) 20

Example: Configuring Layer 2 remote port mirroring (with reflector port) 21

Example: Configuring Layer 2 remote port mirroring (with egress port) 23

Example: Configuring Layer 3 remote port mirroring in tunnel mode· 25

Example: Configuring Layer 3 remote port mirroring in ERSPAN mode· 27

Configuring flow mirroring· 30

About flow mirroring· 30

Restrictions and guidelines: Flow mirroring configuration· 30

Flow mirroring tasks at a glance· 30

Configuring a traffic class· 31

Configuring a traffic behavior 31

Configuring a QoS policy· 32

Applying a QoS policy· 32

Applying a QoS policy to an interface· 32

Applying a QoS policy to a VLAN·· 33

Applying a QoS policy globally· 33

Applying a QoS policy to the control plane· 33

Flow mirroring configuration examples· 34

Example: Configuring flow mirroring· 34

 


Configuring port mirroring

About port mirroring

Port mirroring copies the packets passing through a port or CPU to a port that connects to a data monitoring device for packet analysis.

Terminology

The following terms are used in port mirroring configuration.

Mirroring source

The mirroring sources can be one or more monitored ports (called source ports) or CPUs (called source CPUs).

Packets passing through mirroring sources are copied to a port connecting to a data monitoring device for packet analysis. The copies are called mirrored packets.

Source device

The device where the mirroring sources reside is called a source device.

Mirroring destination

The mirroring destination connects to a data monitoring device and is the destination port (also known as the monitor port) of mirrored packets. Mirrored packets are sent out of the monitor port to the data monitoring device.

A monitor port might receive multiple copies of a packet when it monitors multiple mirroring sources. For example, two copies of a packet are received on Port A when the following conditions exist:

·          Port A is monitoring bidirectional traffic of Port B and Port C on the same device.

·          The packet travels from Port B to Port C.

Destination device

The device where the monitor port resides is called the destination device.

Mirroring direction

The mirroring direction specifies the direction of the traffic that is copied on a mirroring source.

·          Inbound—Copies packets received.

·          Outbound—Copies packets sent.

·          Bidirectional—Copies packets received and sent.

Mirroring group

Port mirroring is implemented through mirroring groups. Mirroring groups can be classified into local mirroring groups, remote source groups, and remote destination groups.

Reflector port, egress port, and remote probe VLAN

Reflector ports, remote probe VLANs, and egress ports are used for Layer 2 remote port mirroring. The remote probe VLAN is a dedicated VLAN for transmitting mirrored packets to the destination device. Both the reflector port and egress port reside on a source device and send mirrored packets to the remote probe VLAN.

On port mirroring devices, all ports except source, destination, reflector, and egress ports are called common ports.

Port mirroring classification

Port mirroring can be classified into local port mirroring and remote port mirroring.

·          Local port mirroringThe source device is directly connected to a data monitoring device. The source device also acts as the destination device and forwards mirrored packets directly to the data monitoring device.

·          Remote port mirroring—The source device is not directly connected to a data monitoring device. The source device sends mirrored packets to the destination device, which forwards the packets to the data monitoring device.

Remote port mirroring can be further classified into Layer 2 and Layer 3 remote port mirroring:

¡  Layer 2 remote port mirroring—The source device and destination device are on the same Layer 2 network.

¡  Layer 3 remote port mirroring—The source device and destination device are separated by IP networks.

Local port mirroring

Figure 1 Local port mirroring implementation

As shown in Figure 1, the source port (Port A) and the monitor port (Port B) reside on the same device. Packets received on Port A are copied to Port B. Port B then forwards the packets to the data monitoring device for analysis.

Layer 2 remote port mirroring

In Layer 2 remote port mirroring, the mirroring sources and destination reside on different devices and are in different mirroring groups.

A remote source group is a mirroring group that contains the mirroring sources. A remote destination group is a mirroring group that contains the mirroring destination. Intermediate devices are the devices between the source device and the destination device.

Layer 2 remote port mirroring can be implemented through the reflector port method or the egress port method.

Reflector port method

In Layer 2 remote port mirroring that uses the reflector port method, packets are mirrored as follows:

1.        The source device copies packets received on the mirroring sources to the reflector port.

2.        The reflector port broadcasts the mirrored packets in the remote probe VLAN.

3.        The intermediate devices transmit the mirrored packets to the destination device through the remote probe VLAN.

4.        Upon receiving the mirrored packets, the destination device determines whether the ID of the mirrored packets is the same as the remote probe VLAN ID. If the two VLAN IDs match, the destination device forwards the mirrored packets to the data monitoring device through the monitor port.

Figure 2 Layer 2 remote port mirroring implementation through the reflector port method

 

Egress port method

In Layer 2 remote port mirroring that uses the egress port method, packets are mirrored as follows:

1.        The source device copies packets received on the mirroring sources to the egress port.

2.        The egress port forwards the mirrored packets to the intermediate devices.

3.        The intermediate devices flood the mirrored packets in the remote probe VLAN and transmit the mirrored packets to the destination device.

4.        Upon receiving the mirrored packets, the destination device determines whether the ID of the mirrored packets is the same as the remote probe VLAN ID. If the two VLAN IDs match, the destination device forwards the mirrored packets to the data monitoring device through the monitor port.

Figure 3 Layer 2 remote port mirroring implementation through the egress port method

 

Layer 3 remote port mirroring

Layer 3 remote port mirroring is implemented through configuring a local mirroring group on both the source device and the destination device.

Configure the mirroring sources and destination for the local mirroring groups on the source device and destination device as follows:

·          On the source device:

¡  Configure the ports to be monitored as source ports.

¡  Configure the CPUs to be monitored as source CPUs.

¡  Configure the tunnel interface through which mirrored packets are forwarded to the destination device as the monitor port.

·          On the destination device:

¡  Configure the physical port corresponding to the tunnel interface as the source port.

¡  Configure the port that connects to the data monitoring device as the monitor port.

For example, in a network as shown in Figure 4, Layer 3 remote port mirroring works as follows:

1.        The source device sends one copy of a packet received on the source port (Port A) to the tunnel interface.

The tunnel interface acts as the monitor port in the local mirroring group created on the source device.

2.        The tunnel interface on the source device forwards the mirrored packet to the tunnel interface on the destination device through the GRE tunnel.

3.        The destination device receives the mirrored packet from the physical interface of the tunnel interface.

The tunnel interface acts as the source port in the local mirroring group created on the destination device.

4.        The physical interface of the tunnel interface sends one copy of the packet to the monitor port (Port B).

5.        The monitor port (Port B) forwards the packet to the data monitoring device.

For more information about GRE tunnels and tunnel interfaces, see Layer 3—IP Services Configuration Guide.

Figure 4 Layer 3 remote port mirroring implementation

Restrictions and guidelines: Port mirroring configuration

The reflector port method for Layer 2 remote port mirroring can be used to implement local port mirroring with multiple data monitoring devices.

In the reflector port method, the reflector port broadcasts mirrored packets in the remote probe VLAN. By assigning the ports that connect to data monitoring devices to the remote probe VLAN, you can implement local port mirroring to mirror packets to multiple data monitoring devices. The egress port method cannot implement local port mirroring in this way.

For inbound traffic mirroring, the VLAN tag in the original packet is copied to the mirrored packet.

For outbound traffic mirroring, the VLAN tag in the mirrored packet identifies the VLAN to which the packet belongs before it is sent out of the source port.

Configuring local port mirroring

Restrictions and guidelines for local port mirroring configuration

A local mirroring group takes effect only after it is configured with the monitor port and mirroring sources.

A local mirroring group supports multicard mirroring. The mirroring sources and destination can reside on different cards.

A Layer 3 aggregate interface cannot be configured as the monitor port for a local mirroring group.

Local port mirroring tasks at a glance

To configure local port mirroring, perform the following tasks:

1.        Configuring mirroring sources

Choose one of the following tasks:

¡  Configuring source ports

¡  Configuring source CPUs

2.        Configuring the monitor port

Creating a local mirroring group

1.        Enter system view.

system-view

2.        Create a local mirroring group.

mirroring-group group-id local

Configuring mirroring sources

Restrictions and guidelines for mirroring source configuration

When you configure source ports for a local mirroring group, follow these restrictions and guidelines:

·          A mirroring group can contain multiple source ports.

·          A port can be assigned to different mirroring groups as follows:

¡  When acting as a source port for unidirectional mirroring, the port can be assigned to up to four mirroring groups.

¡  When acting as a source port for bidirectional mirroring, the port can be assigned to up to two mirroring groups.

¡  When acting as a source port for unidirectional and bidirectional mirroring, the port can be assigned to up to three mirroring groups. One mirroring group is used for bidirectional mirroring and the other two for unidirectional mirroring.

·          A source port cannot be configured as a reflector port, egress port, or monitor port.

A local mirroring group can contain multiple source CPUs.

Configuring source ports

·          Configure source ports in system view:

a.    Enter system view.

system-view

b.    Configure source ports for a local mirroring group.

mirroring-group group-id mirroring-port interface-list { both | inbound | outbound }

By default, no source port is configured for a local mirroring group.

·          Configure source ports in interface view:

a.    Enter system view.

system-view

b.    Enter interface view.

interface interface-type interface-number

c.    Configure the port as a source port for a local mirroring group.

mirroring-group group-id mirroring-port { both | inbound | outbound }

By default, a port does not act as a source port for any local mirroring groups.

Configuring source CPUs

1.        Enter system view.

system-view

2.        Configure source CPUs for a local mirroring group.

In standalone mode:

mirroring-group group-id mirroring-cpu slot slot-number-list { both | inbound | outbound }

In IRF mode:

mirroring-group group-id mirroring-cpu chassis chassis-number slot slot-number-list { both | inbound | outbound }

By default, no source CPU is configured for a local mirroring group.

The device supports mirroring only inbound traffic of a source CPU.

Configuring the monitor port

Restrictions and guidelines

Do not enable the spanning tree feature on the monitor port.

Only one monitor port can be configured for a local mirroring group.

For a Layer 2 aggregate interface configured as the monitor port of a mirroring group, do not configure its member ports as source ports of the mirroring group.

Use a monitor port only for port mirroring, so the data monitoring device receives only the mirrored traffic.

Procedure

·          Configure the monitor port in system view:

a.    Enter system view.

system-view

b.    Configure the monitor port for a local mirroring group.

mirroring-group group-id monitor-port interface-list

By default, no monitor port is configured for a local mirroring group.

·          Configure the monitor port in interface view:

a.    Enter system view.

system-view

b.    Enter interface view.

interface interface-type interface-number

c.    Configure the port as the monitor port for a mirroring group.

mirroring-group group-id monitor-port

By default, a port does not act as the monitor port for any local mirroring groups.

Configuring Layer 2 remote port mirroring

Restrictions and guidelines for Layer 2 remote port mirroring configuration

To ensure successful traffic mirroring, configure devices in the order of the destination device, the intermediate devices, and the source device.

If intermediate devices exist, configure the intermediate devices to allow the remote probe VLAN to pass through.

For a mirrored packet to successfully arrive at the remote destination device, make sure its VLAN ID is not removed or changed.

Do not configure both MVRP and Layer 2 remote port mirroring. Otherwise, MVRP might register the remote probe VLAN with incorrect ports, which would cause the monitor port to receive undesired copies. For more information about MVRP, see Layer 2—LAN Switching Configuration Guide.

To monitor the bidirectional traffic of a source port, disable MAC address learning for the remote probe VLAN on the source, intermediate, and destination devices. For more information about MAC address learning, see Layer 2—LAN Switching Configuration Guide.

Layer 2 remote port mirroring with reflector port configuration task list

Configuring the destination device

1.        Creating a remote destination group

2.        Configuring the monitor port

3.        Configuring the remote probe VLAN

4.        Assigning the monitor port to the remote probe VLAN

Configuring the source device

1.        Creating a remote source group

2.        Configuring mirroring sources

Choose one of the following tasks:

¡  Configuring source ports

¡  Configuring source CPUs

3.        Configuring the reflector port

4.        Configuring the remote probe VLAN

Layer 2 remote port mirroring with egress port configuration task list

Configuring the destination device

1.        Creating a remote destination group

2.        Configuring the monitor port

3.        Configuring the remote probe VLAN

4.        Assigning the monitor port to the remote probe VLAN

Configuring the source device

1.        Creating a remote source group

2.        Configuring mirroring sources

Choose one of the following tasks:

¡  Configuring source ports

¡  Configuring source CPUs

3.        Configuring the egress port

4.        Configuring the remote probe VLAN

Creating a remote destination group

Restrictions and guidelines

Perform this task on the destination device only.

Procedure

1.        Enter system view.

system-view

2.        Create a remote destination group.

mirroring-group group-id remote-destination

Configuring the monitor port

Restrictions and guidelines for monitor port configuration

Perform this task on the destination device only.

Do not enable the spanning tree feature on the monitor port.

Only one monitor port can be configured for a remote destination group.

For a Layer 2 aggregate interface configured as the monitor port of a mirroring group, do not configure its member ports as source ports of the mirroring group.

Use a monitor port only for port mirroring, so the data monitoring device receives only the mirrored traffic.

A monitor port can belong to only one mirroring group.

Configuring the monitor port in system view

1.        Enter system view.

system-view

2.        Configure the monitor port for a remote destination group.

mirroring-group group-id monitor-port interface-list

By default, no monitor port is configured for a remote destination group.

Configuring the monitor port in interface view

1.        Enter system view.

system-view

2.        Enter interface view.

interface interface-type interface-number

3.        Configure the port as the monitor port for a remote destination group.

mirroring-group group-id monitor-port

By default, a port does not act as the monitor port for any remote destination groups.

Configuring the remote probe VLAN

Restrictions and guidelines

This task is required on the both the source and destination devices.

Only an existing static VLAN can be configured as a remote probe VLAN.

When a VLAN is configured as a remote probe VLAN, use the remote probe VLAN for port mirroring exclusively.

Configure the same remote probe VLAN for the remote source group and the remote destination group.

Procedure

1.        Enter system view.

system-view

2.        Configure the remote probe VLAN for the remote source or destination group.

mirroring-group group-id remote-probe vlan vlan-id

By default, no remote probe VLAN is configured for a remote source or destination group.

Assigning the monitor port to the remote probe VLAN

Restrictions and guidelines

Perform this task on the destination device only.

Procedure

1.        Enter system view.

system-view

2.        Enter the interface view of the monitor port.

interface interface-type interface-number

3.        Assign the port to the remote probe VLAN.

¡  Assign an access port to the remote probe VLAN.

port access vlan vlan-id

¡  Assign a trunk port to the remote probe VLAN.

port trunk permit vlan vlan-id

¡  Assign a hybrid port to the remote probe VLAN.

port hybrid vlan vlan-id { tagged | untagged }

For more information about the port access vlan, port trunk permit vlan, and port hybrid vlan commands, see Layer 2—LAN Switching Command Reference.

Creating a remote source group

Restrictions and guidelines

Perform this task on the source device only.

Procedure

1.        Enter system view.

system-view

2.        Create a remote source group.

mirroring-group group-id remote-source

Configuring mirroring sources

Restrictions and guidelines for mirroring source configuration

Perform this task on the source device only.

When you configure source ports for a remote source group, follow these restrictions and guidelines:

·          Do not assign a source port of a mirroring group to the remote probe VLAN of the mirroring group.

·          A mirroring group can contain multiple source ports.

·          A port can be assigned to different mirroring groups as follows:

¡  When acting as a source port for unidirectional mirroring, the port can be assigned to up to four mirroring groups.

¡  When acting as a source port for bidirectional mirroring, the port can be assigned to up to two mirroring groups.

¡  When acting as a source port for unidirectional and bidirectional mirroring, the port can be assigned to up to three mirroring groups. One mirroring group is used for bidirectional mirroring and the other two for unidirectional mirroring.

·          A source port cannot be configured as a reflector port, monitor port, or egress port.

A mirroring group can contain multiple source CPUs.

Configuring source ports

·          Configure source ports in system view:

a.    Enter system view.

system-view

b.    Configure source ports for a remote source group.

mirroring-group group-id mirroring-port interface-list { both | inbound | outbound }

By default, no source port is configured for a remote source group.

·          Configure source ports in interface view:

a.    Enter system view.

system-view

b.    Enter interface view.

interface interface-type interface-number

c.    Configure the port as a source port for a remote source group.

mirroring-group group-id mirroring-port { both | inbound | outbound }

By default, a port does not act as a source port for any remote source groups.

Configuring source CPUs

1.        Enter system view.

system-view

2.        Configure source CPUs for a remote source group.

In standalone mode:

mirroring-group group-id mirroring-cpu slot slot-number-list { both | inbound | outbound }

In IRF mode:

mirroring-group group-id mirroring-cpu chassis chassis-number slot slot-number-list { both | inbound | outbound }

By default, no source CPU is configured for a remote source group.

The device supports mirroring only inbound traffic of a source CPU.

Configuring the reflector port

Restrictions and guidelines for reflector port configuration

Perform this task on the source device only.

The port to be configured as a reflector port must be a port not in use. Do not connect a network cable to a reflector port.

When a port is configured as a reflector port, the default settings of the port are automatically restored. You cannot configure other features on the reflector port.

If an IRF port is bound to only one physical interface, do not configure the physical interface as a reflector port. Otherwise, the IRF might split.

A remote source group supports only one reflector port.

Configuring the reflector port in system view

1.        Enter system view.

system-view

2.        Configure the reflector port for a remote source group.

mirroring-group group-id reflector-port interface-type interface-number

By default, no reflector port is configured for a remote source group.

Configuring the reflector port in interface view

1.        Enter system view.

system-view

2.        Enter interface view.

interface interface-type interface-number

3.        Configure the port as the reflector port for a remote source group.

mirroring-group group-id reflector-port

By default, a port does not act as the reflector port for any remote source groups.

Configuring the egress port

Restrictions and guidelines for egress port configuration

Perform this task on the source device only.

Disable the following features on the egress port:

·          Spanning tree.

·          802.1X.

·          IGMP snooping.

·          Static ARP.

·          MAC address learning.

A port of an existing mirroring group cannot be configured as an egress port.

A mirroring group supports only one egress port.

Configuring the egress port in system view

1.        Enter system view.

system-view

2.        Configure the egress port for a remote source group.

mirroring-group group-id monitor-egress interface-type interface-number

By default, no egress port is configured for a remote source group.

3.        Enter the egress port view.

interface interface-type interface-number

4.        Assign the egress port to the remote probe VLAN.

¡  Assign a trunk port to the remote probe VLAN.

port trunk permit vlan vlan-id

¡  Assign a hybrid port to the remote probe VLAN.

port hybrid vlan vlan-id { tagged | untagged }

For more information about the port trunk permit vlan and port hybrid vlan commands, see Layer 2—LAN Switching Command Reference.

Configuring the egress port in interface view

1.        Enter system view.

system-view

2.        Enter interface view.

interface interface-type interface-number

3.        Configure the port as the egress port for a remote source group.

mirroring-group group-id monitor-egress

By default, a port does not act as the egress port for any remote source groups.

Configuring Layer 3 remote port mirroring (in tunnel mode)

Restrictions and guidelines for Layer 3 remote port mirroring configuration

To implement Layer 3 remote port mirroring, you must configure a unicast routing protocol on the intermediate devices to ensure Layer 3 reachability between the source and destination devices.

Layer 3 remote port mirroring tasks at a glance

Configuring the source device

1.        Configuring local mirroring groups

2.        Configuring mirroring sources

Choose one of the following tasks:

¡  Configuring source ports

¡  Configuring source CPUs

3.        Configuring the monitor port

Configuring the destination device

1.        Configuring local mirroring groups

2.        Configuring mirroring sources

3.        Configuring the monitor port

Prerequisites for Layer 3 remote port mirroring

Before configuring Layer 3 remote mirroring, complete the following tasks:

·          Create a tunnel interface and a GRE tunnel.

·          Configure the source and destination addresses of the tunnel interface as the IP addresses of the physical interfaces on the source and destination devices, respectively.

For more information about tunnel interfaces, see Layer 3—IP Services Configuration Guide.

Configuring local mirroring groups

Restrictions and guidelines

Configure a local mirroring group on both the source device and the destination device.

Procedure

1.        Enter system view.

system-view

2.        Create a local mirroring group.

mirroring-group group-id local

Configuring mirroring sources

Restrictions and guidelines for mirroring source configuration

When you configure source ports for a local mirroring group, follow these restrictions and guidelines:

·          On the source device, configure the ports you want to monitor as the source ports. On the destination device, configure the physical interface corresponding to the tunnel interface as the source port.

·          A port can be assigned to different mirroring groups as follows:

¡  When acting as a source port for unidirectional mirroring, the port can be assigned to up to four mirroring groups.

¡  When acting as a source port for bidirectional mirroring, the port can be assigned to up to two mirroring groups.

¡  When acting as a source port for unidirectional and bidirectional mirroring, the port can be assigned to up to three mirroring groups. One mirroring group is used for bidirectional mirroring and the other two for unidirectional mirroring

·          A source port cannot be configured as a reflector port, egress port, or monitor port.

When you configure source CPUs for a local mirroring group, follow these restrictions and guidelines:

·          Perform this task on the source device only.

·          A mirroring group can contain multiple source CPUs.

Configuring source ports

·          Configure source ports in system view:

a.    Enter system view.

system-view

b.    Configure source ports for a local mirroring group.

mirroring-group group-id mirroring-port interface-list { both | inbound | outbound }

By default, no source port is configured for a local mirroring group.

·          Configure source ports in interface view:

a.    Enter system view.

system-view

b.    Enter interface view.

interface interface-type interface-number

c.    Configure the port as a source port for a local mirroring group.

mirroring-group group-id mirroring-port { both | inbound | outbound }

By default, a port does not act as a source port for any local mirroring groups.

Configuring source CPUs

1.        Enter system view.

system-view

2.        Configure source CPUs for a local mirroring group.

In standalone mode:

mirroring-group group-id mirroring-cpu slot slot-number-list { both | inbound | outbound }

In IRF mode:

mirroring-group group-id mirroring-cpu chassis chassis-number slot slot-number-list { both | inbound | outbound }

By default, no source CPU is configured for a local mirroring group.

The device supports mirroring only the inbound traffic of a source CPU.

Configuring the monitor port

Restrictions and guidelines for monitor port configuration

On the source device, configure the tunnel interface as the monitor port. On the destination device, configure the port that connects to a data monitoring device as the monitor port.

Do not enable the spanning tree feature on the monitor port.

On the source device, only one monitor port (tunnel interface) can be configured for a local mirroring group.

On the destination device, only one monitor port can be configured for a local mirroring group.

Use a monitor port only for port mirroring, so the data monitoring device receives only the mirrored traffic.

If the monitor port of a local mirroring group is an aggregate interface, make sure the member ports in the service loopback group and the source ports in the local mirroring group belong to the same interface group. Execute the display qos-acl resource command. In the command output, interfaces following each Interfaces field belong to the same interface group.

 

 

Procedure

·          Configure the monitor port in system view:

a.    Enter system view.

system-view

b.    Configure the monitor port for a local mirroring group.

mirroring-group group-id monitor-port interface-list

By default, no monitor port is configured for a local mirroring group.

·          Configure the monitor port in interface view:

a.    Enter system view.

system-view

b.    Enter interface view.

interface interface-type interface-number

c.    Configure the port as the monitor port for a local mirroring group.

mirroring-group group-id monitor-port

By default, a port does not act as the monitor port for any local mirroring groups.

Configuring Layer 3 remote port mirroring (in ERSPAN mode)

Restrictions and guidelines for Layer 3 remote port mirroring in ERSPAN mode configuration

To implement Layer 3 remote port mirroring in Encapsulated Remote Switch Port Analyzer (ERSPAN) mode, perform the following tasks:

1.        On the source device, create a local mirroring group and configure the mirroring sources, the monitor port, and the encapsulation parameters for mirrored packets.

The mirrored packet sent to the monitor port is first encapsulated in a GRE packet with a protocol number of 0x88BE. The GRE packet is then encapsulated in a delivery protocol by using the encapsulation parameters and routed to the destination data monitoring device.

2.        On all devices from source to destination, configure a unicast routing protocol to ensure Layer 3 reachability between the devices.

For Layer 3 remote port mirroring to work correctly, do not assign a source port or monitor port to a source VLAN.

In Layer 3 remote port mirroring in ERSPAN mode, the data monitoring device must be able to remove the outer headers to obtain the original mirrored packets for analysis.

Layer 3 remote port mirroring tasks at a glance

To configure Layer 3 remote port mirroring in ERSPAN mode, perform the following tasks:

1.        Creating a local mirroring group on the source device

2.        Configuring mirroring sources

Choose one of the following tasks:

¡  Configuring source ports

¡  Configuring source CPUs

3.        Configuring the monitor port

Creating a local mirroring group on the source device

1.        Enter system view.

system-view

2.        Create a local mirroring group.

mirroring-group group-id local

Configuring mirroring sources

Restrictions and guidelines for mirroring source configuration

When you configure source ports for the local mirroring group, follow these restrictions and guidelines:

·          An interface can be assigned to a maximum of four mirroring groups as a unidirectional source port, to a maximum of two mirroring groups as a bidirectional source port, or to one mirroring group as a bidirectional source port and to two mirroring groups as a unidirectional source port.

·          A source port cannot be configured as a reflector port, egress port, or monitor port.

 

When you configure source VLANs for the local mirroring group, follow these restrictions and guidelines:

·          To monitor the packets (incoming, outgoing, or both) of a VLAN passing through the source device, specify the VLAN as a source VLAN.

·          A VLAN can act as a source VLAN for only one mirroring group.

·          A local mirroring group can contain multiple source VLANs.

A local mirroring group can contain multiple source CPUs.

Configuring source ports

·          Configure source ports in system view:

a.    Enter system view.

system-view

b.    Configure source ports for a local mirroring group.

mirroring-group group-id mirroring-port interface-list { both | inbound | outbound }

By default, no source port is configured for a local mirroring group.

·          Configure source ports in interface view:

a.    Enter system view.

system-view

b.    Enter interface view.

interface interface-type interface-number

c.    Configure the port as a source port for a local mirroring group.

mirroring-group group-id mirroring-port { both | inbound | outbound }

Configuring source CPUs

1.        Enter system view.

system-view

2.        Configure source CPUs for a local mirroring group.

In standalone mode:

mirroring-group group-id mirroring-cpu slot slot-number-list { both | inbound | outbound }

In IRF mode:

mirroring-group group-id mirroring-cpu chassis chassis-number slot slot-number-list { both | inbound | outbound }

By default, no source CPU is configured for a local mirroring group.

Configuring the monitor port

Restrictions and guidelines

Do not enable the spanning tree feature on the monitor port.

Only one monitor port can be configured for a local mirroring group.

Use a monitor port only for port mirroring, so the data monitoring device receives only the mirrored traffic.

If the monitor port of a local mirroring group is an aggregate interface, make sure the member ports in the aggregate interface and the source ports in the local mirroring group belong to the same interface group. Execute the display qos-acl resource command. In the command output, interfaces following each Interfaces field belong to the same interface group.

单击此处输入文字。

 

Procedure

·          Configure the monitor port in system view:

a.    Enter system view.

system-view

b.    Configure the monitor port in a local mirroring group and specify the encapsulation parameters.

mirroring-group group-id monitor-port interface-type interface-number destination-ip destination-ip-address source-ip source-ip-address [ dscp dscp-value | vlan vlan-id | vrf-instance vrf-name ] *

By default, no monitor port is configured for a local mirroring group.

·          Configure the monitor port in interface view:

a.    Enter system view.

system-view

b.    Enter interface view.

interface interface-type interface-number

c.    Specify the port as the monitor port in a local mirroring group and configure the encapsulation parameters in a local mirroring group.

mirroring-group group-id monitor-port destination-ip destination-ip-address source-ip source-ip-address [ dscp dscp-value | vlan vlan-id | vrf-instance vrf-name ] *

By default, a port does not act as the monitor port for any local mirroring groups.

Display and maintenance commands for port mirroring

Execute display commands in any view.

 

Task

Command

Display mirroring group information.

display mirroring-group { group-id | all | local | remote-destination | remote-source }

 

Port mirroring configuration examples

Example: Configuring local port mirroring (in source port mode)

Network configuration

As shown in Figure 5, configure local port mirroring in source port mode to enable the server to monitor the bidirectional traffic of the two departments.

Figure 5 Network diagram

Procedure

# Create local mirroring group 1.

<Device> system-view

[Device] mirroring-group 1 local

# Configure HundredGigE 1/0/1 and HundredGigE 1/0/2 as source ports for local mirroring group 1.

[Device] mirroring-group 1 mirroring-port hundredgige 1/0/1 hundredgige 1/0/2 both

# Configure HundredGigE 1/0/3 as the monitor port for local mirroring group 1.

[Device] mirroring-group 1 monitor-port hundredgige 1/0/3

# Disable the spanning tree feature on the monitor port (HundredGigE 1/0/3).

[Device] interface hundredgige 1/0/3

[Device-HundredGigE1/0/3] undo stp enable

[Device-HundredGigE1/0/3] quit

Verifying the configuration

# Verify the mirroring group configuration.

[Device] display mirroring-group all

Mirroring group 1:

    Type: Local

    Status: Active

    Mirroring port:

        HundredGigE1/0/1  Both

        HundredGigE1/0/2  Both

    Monitor port: HundredGigE1/0/3

Example: Configuring local port mirroring (in source CPU mode)

Network configuration

As shown in Figure 6, HundredGigE 1/0/1 and HundredGigE 1/0/2 are located on the card in slot 1.

Configure local port mirroring in source CPU mode to enable the server to monitor all packets matching the following criteria:

·          Received by the Marketing Department and the Technical Department.

·          Processed by the CPU in slot 1 of the device.

Figure 6 Network diagram

Procedure

# Create local mirroring group 1.

<Device> system-view

[Device] mirroring-group 1 local

# Configure the CPU in slot 1 of the device as a source CPU for local mirroring group 1.

[Device] mirroring-group 1 mirroring-cpu slot 1 inbound

# Configure HundredGigE 1/0/3 as the monitor port for local mirroring group 1.

[Device] mirroring-group 1 monitor-port hundredgige 1/0/3

# Disable the spanning tree feature on the monitor port (HundredGigE 1/0/3).

[Device] interface hundredgige 1/0/3

[Device-HundredGigE1/0/3] undo stp enable

[Device-HundredGigE1/0/3] quit

Verifying the configuration

# Verify the mirroring group configuration.

[Device] display mirroring-group all

Mirroring group 1:

    Type: Local

    Status: Active

    Mirroring CPU:

        Slot 1  Inbound

    Monitor port: HundredGigE1/0/3

Example: Configuring Layer 2 remote port mirroring (with reflector port)

Network configuration

As shown in Figure 7, configure Layer 2 remote port mirroring to enable the server to monitor the bidirectional traffic of the Marketing Department.

Figure 7 Network diagram

Procedure

1.        Configure Device C (the destination device):

# Configure HundredGigE 1/0/1 as a trunk port, and assign the port to VLAN 2.

<DeviceC> system-view

[DeviceC] interface hundredgige 1/0/1

[DeviceC-HundredGigE1/0/1] port link-type trunk

[DeviceC-HundredGigE1/0/1] port trunk permit vlan 2

[DeviceC-HundredGigE1/0/1] quit

# Create a remote destination group.

[DeviceC] mirroring-group 2 remote-destination

# Create VLAN 2.

[DeviceC] vlan 2

# Disable MAC address learning for VLAN 2.

[DeviceC-vlan2] undo mac-address mac-learning enable

[DeviceC-vlan2] quit

# Configure VLAN 2 as the remote probe VLAN for the mirroring group.

[DeviceC] mirroring-group 2 remote-probe vlan 2

# Configure HundredGigE 1/0/2 as the monitor port for the mirroring group.

[DeviceC] interface hundredgige 1/0/2

[DeviceC-HundredGigE1/0/2] mirroring-group 2 monitor-port

# Disable the spanning tree feature on HundredGigE 1/0/2.

[DeviceC-HundredGigE1/0/2] undo stp enable

# Assign HundredGigE 1/0/2 to VLAN 2.

[DeviceC-HundredGigE1/0/2] port access vlan 2

[DeviceC-HundredGigE1/0/2] quit

2.        Configure Device B (the intermediate device):

# Create VLAN 2.

<DeviceB> system-view

[DeviceB] vlan 2

# Disable MAC address learning for VLAN 2.

[DeviceB-vlan2] undo mac-address mac-learning enable

[DeviceB-vlan2] quit

# Configure HundredGigE 1/0/1 as a trunk port, and assign the port to VLAN 2.

[DeviceB] interface hundredgige 1/0/1

[DeviceB-HundredGigE1/0/1] port link-type trunk

[DeviceB-HundredGigE1/0/1] port trunk permit vlan 2

[DeviceB-HundredGigE1/0/1] quit

# Configure HundredGigE 1/0/2 as a trunk port, and assign the port to VLAN 2.

[DeviceB] interface hundredgige 1/0/2

[DeviceB-HundredGigE1/0/2] port link-type trunk

[DeviceB-HundredGigE1/0/2] port trunk permit vlan 2

[DeviceB-HundredGigE1/0/2] quit

3.        Configure Device A (the source device):

# Create a remote source group.

<DeviceA> system-view

[DeviceA] mirroring-group 1 remote-source

# Create VLAN 2.

[DeviceA] vlan 2

# Disable MAC address learning for VLAN 2.

[DeviceA-vlan2] undo mac-address mac-learning enable

[DeviceA-vlan2] quit

# Configure VLAN 2 as the remote probe VLAN for the mirroring group.

[DeviceA] mirroring-group 1 remote-probe vlan 2

# Configure HundredGigE 1/0/1 as a source port for the mirroring group.

[DeviceA] mirroring-group 1 mirroring-port hundredgige 1/0/1 both

# Configure HundredGigE 1/0/3 as the reflector port for the mirroring group.

[DeviceA] mirroring-group 1 reflector-port hundredgige 1/0/3

This operation may delete all settings made on the interface. Continue? [Y/N]: y

# Configure HundredGigE 1/0/2 as a trunk port, and assign the port to VLAN 2.

[DeviceA] interface hundredgige 1/0/2

[DeviceA-HundredGigE1/0/2] port link-type trunk

[DeviceA-HundredGigE1/0/2] port trunk permit vlan 2

[DeviceA-HundredGigE1/0/2] quit

Verifying the configuration

# Verify the mirroring group configuration on Device C.

[DeviceC] display mirroring-group all

Mirroring group 2:

    Type: Remote destination

    Status: Active

    Monitor port: HundredGigE1/0/2

    Remote probe VLAN: 2

# Verify the mirroring group configuration on Device A.

[DeviceA] display mirroring-group all

Mirroring group 1:

    Type: Remote source

    Status: Active

    Mirroring port:

        HundredGigE1/0/1  Both

    Reflector port: HundredGigE1/0/3

    Remote probe VLAN: 2

Example: Configuring Layer 2 remote port mirroring (with egress port)

Network configuration

On the Layer 2 network shown in Figure 8, configure Layer 2 remote port mirroring to enable the server to monitor the bidirectional traffic of the Marketing Department.

Figure 8 Network diagram

Procedure

1.        Configure Device C (the destination device):

# Configure HundredGigE 1/0/1 as a trunk port, and assign the port to VLAN 2.

<DeviceC> system-view

[DeviceC] interface hundredgige 1/0/1

[DeviceC-HundredGigE1/0/1] port link-type trunk

[DeviceC-HundredGigE1/0/1] port trunk permit vlan 2

[DeviceC-HundredGigE1/0/1] quit

# Create a remote destination group.

[DeviceC] mirroring-group 2 remote-destination

# Create VLAN 2.

[DeviceC] vlan 2

# Disable MAC address learning for VLAN 2.

[DeviceC-vlan2] undo mac-address mac-learning enable

[DeviceC-vlan2] quit

# Configure VLAN 2 as the remote probe VLAN for the mirroring group.

[DeviceC] mirroring-group 2 remote-probe vlan 2

# Configure HundredGigE 1/0/2 as the monitor port for the mirroring group.

[DeviceC] interface hundredgige 1/0/2

[DeviceC-HundredGigE1/0/2] mirroring-group 2 monitor-port

# Disable the spanning tree feature on HundredGigE 1/0/2.

[DeviceC-HundredGigE1/0/2] undo stp enable

# Assign HundredGigE 1/0/2 to VLAN 2 as an access port.

[DeviceC-HundredGigE1/0/2] port access vlan 2

[DeviceC-HundredGigE1/0/2] quit

2.        Configure Device B (the intermediate device):

# Create VLAN 2.

<DeviceB> system-view

[DeviceB] vlan 2

# Disable MAC address learning for VLAN 2.

[DeviceB-vlan2] undo mac-address mac-learning enable

[DeviceB-vlan2] quit

# Configure HundredGigE 1/0/1 as a trunk port, and assign the port to VLAN 2.

[DeviceB] interface hundredgige 1/0/1

[DeviceB-HundredGigE1/0/1] port link-type trunk

[DeviceB-HundredGigE1/0/1] port trunk permit vlan 2

[DeviceB-HundredGigE1/0/1] quit

# Configure HundredGigE 1/0/2 as a trunk port, and assign the port to VLAN 2.

[DeviceB] interface hundredgige 1/0/2

[DeviceB-HundredGigE1/0/2] port link-type trunk

[DeviceB-HundredGigE1/0/2] port trunk permit vlan 2

[DeviceB-HundredGigE1/0/2] quit

3.        Configure Device A (the source device):

# Create a remote source group.

<DeviceA> system-view

[DeviceA] mirroring-group 1 remote-source

# Create VLAN 2.

[DeviceA] vlan 2

# Disable MAC address learning for VLAN 2.

[DeviceA-vlan2] undo mac-address mac-learning enable

[DeviceA-vlan2] quit

# Configure VLAN 2 as the remote probe VLAN of the mirroring group.

[DeviceA] mirroring-group 1 remote-probe vlan 2

# Configure HundredGigE 1/0/1 as a source port for the mirroring group.

[DeviceA] mirroring-group 1 mirroring-port hundredgige 1/0/1 both

# Configure HundredGigE 1/0/2 as the egress port for the mirroring group.

[DeviceA] mirroring-group 1 monitor-egress hundredgige 1/0/2

# Configure HundredGigE 1/0/2 as a trunk port, and assign the port to VLAN 2.

[DeviceA] interface hundredgige 1/0/2

[DeviceA-HundredGigE1/0/2] port link-type trunk

[DeviceA-HundredGigE1/0/2] port trunk permit vlan 2

# Disable the spanning tree feature on the port.

[DeviceA-HundredGigE1/0/2] undo stp enable

[DeviceA-HundredGigE1/0/2] quit

Verifying the configuration

# Verify the mirroring group configuration on Device C.

[DeviceC] display mirroring-group all

Mirroring group 2:

    Type: Remote destination

    Status: Active

    Monitor port: HundredGigE1/0/2

    Remote probe VLAN: 2

# Verify the mirroring group configuration on Device A.

[DeviceA] display mirroring-group all

Mirroring group 1:

    Type: Remote source

    Status: Active

    Mirroring port:

        HundredGigE1/0/1  Both

    Monitor egress port: HundredGigE1/0/2

    Remote probe VLAN: 2

Example: Configuring Layer 3 remote port mirroring in tunnel mode

Network configuration

On a Layer 3 network shown in Figure 9, configure Layer 3 remote port mirroring to enable the server to monitor the bidirectional traffic of the Marketing Department.

Figure 9 Network diagram

Procedure

1.        Configure IP addresses for the tunnel interfaces and related ports on the devices. (Details not shown.)

2.        Configure Device A (the source device):

# Create service loopback group 1 and specify the unicast tunnel service for the group.

<DeviceA> system-view

[DeviceA] service-loopback group 1 type tunnel

# Assign HundredGigE 1/0/3 to service loopback group 1.

[DeviceA] interface hundredgige 1/0/3

[DeviceA-HundredGigE1/0/3] port service-loopback group 1

All configurations on the interface will be lost. Continue?[Y/N]:y

[DeviceA-HundredGigE1/0/3] quit

# Create tunnel interface Tunnel 0 that operates in GRE mode, and configure an IP address and subnet mask for the interface.

[DeviceA] interface tunnel 0 mode gre

[DeviceA-Tunnel0] ip address 50.1.1.1 24

# Configure source and destination IP addresses for Tunnel 0.

[DeviceA-Tunnel0] source 20.1.1.1

[DeviceA-Tunnel0] destination 30.1.1.2

[DeviceA-Tunnel0] quit

# Enable the OSPF protocol.

[DeviceA] ospf 1

[DeviceA-ospf-1] area 0

[DeviceA-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.0] network 20.1.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.0] quit

[DeviceA-ospf-1] quit

# Create local mirroring group 1.

[DeviceA] mirroring-group 1 local

# Configure HundredGigE 1/0/1 as a source port and Tunnel 0 as the monitor port of local mirroring group 1.

[DeviceA] mirroring-group 1 mirroring-port hundredgige 1/0/1 both

[DeviceA] mirroring-group 1 monitor-port tunnel 0

3.        Enable the OSPF protocol on Device B (the intermediate device).

<DeviceB> system-view

[DeviceB] ospf 1

[DeviceB-ospf-1] area 0

[DeviceB-ospf-1-area-0.0.0.0] network 20.1.1.0 0.0.0.255

[DeviceB-ospf-1-area-0.0.0.0] network 30.1.1.0 0.0.0.255

[DeviceB-ospf-1-area-0.0.0.0] quit

[DeviceB-ospf-1] quit

4.        Configure Device C (the destination device):

# Create service loopback group 1 and specify the unicast tunnel service for the group.

<DeviceC> system-view

[DeviceC] service-loopback group 1 type tunnel

# Assign HundredGigE 1/0/3 to service loopback group 1.

[DeviceC] interface hundredgige 1/0/3

[DeviceC-HundredGigE1/0/3] port service-loopback group 1

All configurations on the interface will be lost. Continue?[Y/N]:y

[DeviceC-HundredGigE1/0/3] quit

# Create tunnel interface Tunnel 0 that operates in GRE mode, and configure an IP address and subnet mask for the interface.

[DeviceC] interface tunnel 0 mode gre

[DeviceC-Tunnel0] ip address 50.1.1.2 24

# Configure source and destination IP addresses for Tunnel 0.

[DeviceC-Tunnel0] source 30.1.1.2

[DeviceC-Tunnel0] destination 20.1.1.1

[DeviceC-Tunnel0] quit

# Enable the OSPF protocol.

[DeviceC] ospf 1

[DeviceC-ospf-1] area 0

[DeviceC-ospf-1-area-0.0.0.0] network 30.1.1.0 0.0.0.255

[DeviceC-ospf-1-area-0.0.0.0] network 40.1.1.0 0.0.0.255

[DeviceC-ospf-1-area-0.0.0.0] quit

[DeviceC-ospf-1] quit

# Create local mirroring group 1.

[DeviceC] mirroring-group 1 local

# Configure HundredGigE 1/0/1 as a source port for local mirroring group 1.

[DeviceC] mirroring-group 1 mirroring-port hundredgige 1/0/1 inbound

# Configure HundredGigE 1/0/2 as the monitor port for local mirroring group 1.

[DeviceC] mirroring-group 1 monitor-port hundredgige 1/0/2

Verifying the configuration

# Verify the mirroring group configuration on Device A.

[DeviceA] display mirroring-group all

Mirroring group 1:

    Type: Local

    Status: Active

    Mirroring port:

        HundredGigE1/0/1  Both

    Monitor port: Tunnel0

# Display information about all mirroring groups on Device C.

[DeviceC] display mirroring-group all

Mirroring group 1:

    Type: Local

    Status: Active

    Mirroring port:

        HundredGigE1/0/1  Inbound

    Monitor port: HundredGigE1/0/2

Example: Configuring Layer 3 remote port mirroring in ERSPAN mode

Network configuration

On a Layer 3 network shown in Figure 10, configure Layer 3 remote port mirroring in ERSPAN mode to enable the server to monitor the bidirectional traffic of the Marketing Department.

Figure 10 Network diagram

 

Procedure

1.        Configure IP addresses for the interfaces as shown in Figure 10. (Details not shown.)

2.        Configure Device A (the source device):

# Enable the OSPF protocol.

[DeviceA] ospf 1

[DeviceA-ospf-1] area 0

[DeviceA-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.0] network 20.1.1.0 0.0.0.255

[DeviceA-ospf-1-area-0.0.0.0] quit

[DeviceA-ospf-1] quit

# Create local mirroring group 1.

[DeviceA] mirroring-group 1 local

# Configure HundredGigE 1/0/1 as a source port.

[DeviceA] mirroring-group 1 mirroring-port hundredgige 1/0/1 both

# Configure HundredGigE 1/0/2 as the monitor port. Specify the destination and source IP addresses for mirrored packets as 40.1.1.2 and 20.1.1.1, respectively.

[DeviceA] mirroring-group 1 monitor-port hundredgige 1/0/2 destination-ip 40.1.1.2 source-ip 20.1.1.1

3.        Enable the OSPF protocol on Device B.

<DeviceB> system-view

[DeviceB] ospf 1

[DeviceB-ospf-1] area 0

[DeviceB-ospf-1-area-0.0.0.0] network 20.1.1.0 0.0.0.255

[DeviceB-ospf-1-area-0.0.0.0] network 30.1.1.0 0.0.0.255

[DeviceB-ospf-1-area-0.0.0.0] quit

[DeviceB-ospf-1] quit

4.        Enable the OSPF protocol on Device C.

[DeviceC] ospf 1

[DeviceC-ospf-1] area 0

[DeviceC-ospf-1-area-0.0.0.0] network 30.1.1.0 0.0.0.255

[DeviceC-ospf-1-area-0.0.0.0] network 40.1.1.0 0.0.0.255

[DeviceC-ospf-1-area-0.0.0.0] quit

[DeviceC-ospf-1] quit

Verifying the configuration

# Verify the mirroring group configuration on Device A.

[DeviceA] display mirroring-group all

Mirroring group 1:

    Type: Local

    Status: Active

    Mirroring port:

        HundredGigE1/0/1  Both

    Monitor port: HundredGigE1/0/2

                  Encapsulation: Destination IP address 40.1.1.2

                                 Source IP address 20.1.1.1

                                 Destination MAC address 000f-e241-5e5b


Configuring flow mirroring

About flow mirroring

Flow mirroring copies packets matching a class to a destination for packet analyzing and monitoring. It is implemented through QoS.

To implement flow mirroring through QoS, perform the following tasks:

·          Define traffic classes and configure match criteria to classify packets to be mirrored. Flow mirroring allows you to flexibly classify packets to be analyzed by defining match criteria.

·          Configure traffic behaviors to mirror the matching packets to the specified destination.

You can configure an action to mirror the matching packets to one of the following destinations:

·          Interface—The matching packets are copied to an interface and then forwarded to a data monitoring device for analysis.

·          (In standalone mode.) (In IRF mode.) CPU—The matching packets are copied to the CPU of the card where they are received. The CPU analyzes the packets or delivers them to upper layers.

·          (In standalone mode.) (In IRF mode.) Card—The matching packets are copied to a card for processing.

·          gRPC—The matching packets are copied to a directly-connected Google Remote Procedure Call (gRPC) network management server for further analysis.

·          In-band network telemetry (INT) processor—The matching packets are copied to the INT processor.

For more information about QoS policies, traffic classes, and traffic behaviors, see ACL and QoS Configuration Guide.

Restrictions and guidelines: Flow mirroring configuration

For information about the configuration commands except the mirror-to command, see ACL and QoS Command Reference.

Flow mirroring tasks at a glance

To configure flow mirroring, perform the following tasks:

1.        Configuring a traffic class

A traffic class defines the criteria that filters the traffic to be mirrored.

2.        Configuring a traffic behavior

A traffic behavior specifies mirroring destinations.

3.        Configuring a QoS policy

4.        Applying a QoS policy

Choose one of the following tasks:

¡  Applying a QoS policy to an interface

¡  Applying a QoS policy to a VLAN

¡  Applying a QoS policy globally

¡  Applying a QoS policy to the control plane

Configuring a traffic class

1.        Enter system view.

system-view

2.        Create a class and enter class view.

traffic classifier classifier-name [ operator { and | or } ]

3.        Configure match criteria.

if-match match-criteria

By default, no match criterion is configured in a traffic class.

4.        (Optional.) Display traffic class information.

display traffic classifier

This command is available in any view.

Configuring a traffic behavior

Procedure

1.        Enter system view.

system-view

2.        Create a traffic behavior and enter traffic behavior view.

traffic behavior behavior-name

3.        Configure mirroring destinations for the traffic behavior. Choose one option as needed:

¡  Mirror traffic to interfaces.

Mirror traffic to the specified interface:

mirror-to interface interface-type interface-number [ truncation ] [ loopback | [ destination-ip destination-ip-address source-ip source-ip-address [ dscp dscp-value | vlan vlan-id | vrf-instance vrf-name ] * ]

Mirror traffic to interfaces based on routes matching the specified destination IP address:

mirror-to interface destination-ip destination-ip-address source-ip source-ip-address [ truncation ] [ dscp dscp-value | vlan vlan-id | vrf-instance vrf-name ] *

By default, no mirroring actions exist to mirror traffic to interfaces.

If traffic is mirrored to an aggregate interface, make sure the member ports in the aggregate interface and the incoming interface of the original traffic belong to the same interface group. Execute the display qos-acl resource command. In the command output, interfaces following each Interfaces field belong to the same interface group.

单击此处输入文字。

 

You can mirror traffic to a maximum of four Ethernet interfaces or Layer 2 aggregate interfaces in a traffic behavior.

 

 

 

 

 

 

 

 

 

 

 

 

¡  Mirror traffic to the CPU.

mirror-to cpu

By default, no mirroring actions exist to mirror traffic to the CPU.

¡  Mirror traffic to the directly-connected gRPC network management server.

mirror-to grpc

By default, no mirroring actions exist to mirror traffic to the directly-connected gRPC network management server.

¡  Mirror traffic to the INT processor.

mirror-to ifa-processor [ sampler sampler-name ]

By default, no mirroring actions exist to mirror traffic to the INT processor.

For more information about the INT processor, see INT configuration in Telemetry Configuration Guide.

4.        (Optional.) Display traffic behavior configuration.

display traffic behavior

This command is available in any view.

Configuring a QoS policy

1.        Enter system view.

system-view

2.        Create a QoS policy and enter QoS policy view.

qos policy policy-name

3.        Associate a class with a traffic behavior in the QoS policy.

classifier classifier-name behavior behavior-name

By default, no traffic behavior is associated with a class.

4.        (Optional.) Display QoS policy configuration.

display qos policy

This command is available in any view.

Applying a QoS policy

Applying a QoS policy to an interface

Restrictions and guidelines

You can apply a QoS policy to an interface to mirror the traffic of the interface.

A policy can be applied to multiple interfaces.

In one traffic direction of an interface, only one QoS policy can be applied.

To apply a QoS policy to the outbound traffic of an interface, make sure mirroring actions do not coexist with non-mirroring actions in the same traffic behavior to avoid conflicts.

The device does not support mirroring outbound traffic of an aggregate interface.

Procedure

1.        Enter system view.

system-view

2.        Enter interface view.

interface interface-type interface-number

3.        Apply a policy to the interface.

qos apply policy policy-name { inbound | outbound }

4.        (Optional.) Display the QoS policy applied to the interface.

display qos policy interface

This command is available in any view.

Applying a QoS policy to a VLAN

Restrictions and guidelines

You can apply a QoS policy to a VLAN to mirror the traffic on all ports in the VLAN.

Procedure

1.        Enter system view.

system-view

2.        Apply a QoS policy to a VLAN.

qos vlan-policy policy-name vlan vlan-id-list { inbound | outbound }

3.        (Optional.) Display the QoS policy applied to the VLAN.

display qos vlan-policy

This command is available in any view.

Applying a QoS policy globally

Restrictions and guidelines

You can apply a QoS policy globally to mirror the traffic on all ports.

Procedure

1.        Enter system view.

system-view

2.        Apply a QoS policy globally.

qos apply policy policy-name global { inbound | outbound }

3.        (Optional.) Display global QoS policies.

display qos policy global

This command is available in any view.

Applying a QoS policy to the control plane

Restrictions and guidelines

You can apply a QoS policy to the control plane to mirror the traffic of all ports on the control plane.

Procedure

1.        Enter system view.

system-view

2.        Enter control plane view.

In standalone mode:

control-plane slot slot-number

In IRF mode:

control-plane chassis chassis-number slot slot-number

3.        Apply a QoS policy to the control plane.

qos apply policy policy-name inbound

4.        (Optional.) Display QoS policies applied to the control plane

display qos policy control-plane

This command is available in any view.

Flow mirroring configuration examples

Example: Configuring flow mirroring

Network configuration

As shown in Figure 11, configure flow mirroring so that the server can monitor the following traffic:

·          All traffic that the Technical Department sends to access the Internet.

·          IP traffic that the Technical Department sends to the Marketing Department during working hours (8:00 to 18:00) on weekdays.

Figure 11 Network diagram

Procedure

# Create working hour range work, in which working hours are from 8:00 to 18:00 on weekdays.

<Device> system-view

[Device] time-range work 8:00 to 18:00 working-day

# Create IPv4 advanced ACL 3000 to allow packets from the Technical Department to access the Internet and the Marketing Department during working hours.

[Device] acl advanced 3000

[Device-acl-ipv4-adv-3000] rule permit tcp source 192.168.2.0 0.0.0.255 destination-port eq www

[Device-acl-ipv4-adv-3000] rule permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 time-range work

[Device-acl-ipv4-adv-3000] quit

# Create traffic class tech_c, and configure the match criterion as ACL 3000.

[Device] traffic classifier tech_c

[Device-classifier-tech_c] if-match acl 3000

[Device-classifier-tech_c] quit

# Create traffic behavior tech_b, configure the action of mirroring traffic to HundredGigE 1/0/3.

[Device] traffic behavior tech_b

[Device-behavior-tech_b] mirror-to interface hundredgige 1/0/3

[Device-behavior-tech_b] quit

# Create QoS policy tech_p, and associate traffic class tech_c with traffic behavior tech_b in the QoS policy.

[Device] qos policy tech_p

[Device-qospolicy-tech_p] classifier tech_c behavior tech_b

[Device-qospolicy-tech_p] quit

# Apply QoS policy tech_p to the incoming packets of HundredGigE 1/0/4.

[Device] interface hundredgige 1/0/4

[Device-HundredGigE1/0/4] qos apply policy tech_p inbound

[Device-HundredGigE1/0/4] quit

Verifying the configuration

# Verify that the server can monitor the following traffic:

·          All traffic sent by the Technical Department to access the Internet.

·          IP traffic that the Technical Department sends to the Marketing Department during working hours on weekdays.

(Details not shown.)

  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
All Support
  • Become a Partner
  • Partner Resources
  • Partner Business Management
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us
新华三官网