Contents

Configuring port mirroring· 1

About port mirroring· 1

Terminology· 1

Local port mirroring· 2

Restrictions: Hardware compatibility with port mirroring· 2

Restrictions and guidelines: Port mirroring configuration· 4

Configuring local port mirroring· 4

Restrictions and guidelines for local port mirroring configuration· 4

Local port mirroring tasks at a glance· 5

Creating a local mirroring group· 5

Configuring mirroring sources· 5

Configuring the monitor port 5

Display and maintenance commands for port mirroring· 6

 

Configuring port mirroring

About port mirroring

Port mirroring copies the packets passing through a port to a port that connects to a data monitoring device for packet analysis.

Terminology

The following terms are used in port mirroring configuration.

Mirroring source

The mirroring sources can be one or more monitored ports (called source ports).

Packets passing through mirroring sources are copied to a port connecting to a data monitoring device for packet analysis. The copies are called mirrored packets.

Source device

The device where the mirroring sources reside is called a source device.

Mirroring destination

The mirroring destination connects to a data monitoring device and is the destination port (also known as the monitor port) of mirrored packets. Mirrored packets are sent out of the monitor port to the data monitoring device.

A monitor port might receive multiple copies of a packet when it monitors multiple mirroring sources. For example, two copies of a packet are received on Port A when the following conditions exist:

·     Port A is monitoring bidirectional traffic of Port B and Port C on the same device.

·     The packet travels from Port B to Port C.

Destination device

The device where the monitor port resides is called the destination device.

Mirroring direction

The mirroring direction specifies the direction of the traffic that is copied on a mirroring source.

·     Inbound—Copies packets received.

·     Outbound—Copies packets sent.

·     Bidirectional—Copies packets received and sent.

Mirroring group

Port mirroring is implemented through local mirroring groups. The mirroring sources and destination reside on the same device, which is directly connected to a data monitoring device. Packets received on the mirroring sources are sent through the mirroring destination to the data monitoring device.

Local port mirroring

Figure 1 Local port mirroring implementation

‌

As shown in Figure 1, the source port (Port A) and the monitor port (Port B) reside on the same device. Packets received on Port A are copied to Port B. Port B then forwards the packets to the data monitoring device for analysis.

Restrictions: Hardware compatibility with port mirroring

F1000 series	Models	Feature compatibility
F1000-X-G5 series	F1000-A-G5, F1000-S-G5	Yes only on GE 1/0/0 through GE 1/0/23, XGE 1/0/24, and XGE 1/0/25
	F1000-C-G5, F1000-C-G5-LI	Yes only on GE 1/0/0 through GE1/0/23, GE 1/0/25, XGE 1/0/26, and XGE 1/0/27
	F1000-E-G5, F1000-H-G5	Yes only on GE 1/0/0 through GE 1/0/13, XGE 1/0/18, XGE 1/0/19, GE 1/0/22 through GE 1/0/29, and interfaces on cards in four interface card slots
F1000-X-G3 series	F1000-A-G3, F1000-C-G3, F1000-E-G3, F1000-S-G3	Yes only on GE 1/0/0 through GE 1/0/13, XGE 1/0/18, XGE 1/0/19, GE 1/0/22 through GE 1/0/29, and interfaces on cards in four interface card slots
F1000-X-G2 series	F1000-A-G2, F1000-C-G2, F1000-E-G2, F1000-S-G2	Yes
F1000-9X0-AI series	F1000-9390-AI, F1000-9385-AI	Yes only on GE 1/0/0 through GE 1/0/13, XGE 1/0/18, XGE 1/0/19, GE 1/0/22 through GE 1/0/29, and interfaces on cards in four interface card slots
	F1000-9380-AI, F1000-9370-AI	Yes only on GE 1/0/0 through GE 1/0/23, XGE 1/0/24, and XGE 1/0/25
	F1000-9360-AI, F1000-9350-AI	Yes only on GE 1/0/0 through GE1/0/23, GE 1/0/25, XGE 1/0/26, and XGE 1/0/27
	F1000-990-AI, F1000-980-AI, F1000-970-AI, F1000-960-AI, F1000-950-AI, F1000-930-AI, F1000-920-AI	Yes
	F1000-9330-AI, F1000-9320-AI, F1000-910-AI, F1000-905-AI	No
F1000-C83X0 series	F1000-C8395	Yes only on GE 1/0/0 through GE 1/0/13, XGE 1/0/18, XGE 1/0/19, GE 1/0/22 through GE 1/0/29, and interfaces on cards in four interface card slots
	F1000-C8390, F1000-C8385, F1000-C8380	Yes only on GE 1/0/0 through GE 1/0/23, XGE 1/0/24, and XGE 1/0/25
	F1000-C8370, F1000-C8360, F1000-C8350	Yes only on GE 1/0/0 through GE1/0/23, GE 1/0/25, XGE 1/0/26, and XGE 1/0/27
	F1000-C8330	No
F1000-C81X0 series	F1000-C8180, F1000-C8170, F1000-C8160	Yes
	F1000-C8150, F1000-C8130, F1000-C8120, F1000-C8110	No
F1000-7X0-HI series	F1000-770-HI	Yes only on GE 1/0/0 through GE 1/0/23, XGE 1/0/24, and XGE 1/0/25
	F1000-750-HI, F1000-740-HI	Yes only on GE 1/0/0 through GE1/0/23, GE 1/0/25, XGE 1/0/26, and XGE 1/0/27
	F1000-730-HI, F1000-720-HI, F1000-710-HI	No
F1000-C-X series	F1000-C-EI, F1000-C-HI	Yes
	F1000-C-XI	Yes only on GE 1/0/0 through GE 1/0/23, XGE 1/0/24, and XGE 1/0/25
	F1000-E-XI	Yes only on GE 1/0/0 through GE1/0/23, GE 1/0/25, XGE 1/0/26, and XGE 1/0/27
F1000-V series	F1000-E-VG	Yes
	F1000-S-VG	No
SecBlade IV	LSPM6FWD8, LSQM2FWDSC8	No

‌

F100 series	Models	Feature compatibility
F100-X-G5 series	F100-A-G5, F100-C-G5, F100-M-G5, F100-S-G5	No
	F100-E-G5	Yes only on GE 1/0/0 through GE1/0/23, GE 1/0/25, XGE 1/0/26, and XGE 1/0/27
F100-X-G3 series	F100-A-G3, F100-E-G3	Yes
	F100-C-G3, F100-M-G3, F100-S-G3	No
F100-X-G2 series	F100-A-G2, F100-E-G2	Yes
	F100-C-G2, F100-M-G2, F100-S-G2	No
F100-WiNet series	F100-A80-WiNet	Yes
	F100-C80-WiNet, F100-C60-WiNet, F100-C50-WiNet, F100-S80-WiNet, F100-A81-WiNet	No
	F100-A91-WiNet	Yes only on GE 1/0/0 through GE1/0/23, GE 1/0/25, XGE 1/0/26, and XGE 1/0/27
F100-C-A series	F100-C-A6, F100-C-A5, F100-C-A3, F100-C-A2, F100-C-A1, F100-C-A6-WL, F100-C-A5-W, F100-C-A3-W	No
F100-X-XI series	F100-A-EI, F100-A-HI, F100-A-SI, F100-E-EI	Yes
	F100-C-EI, F100-C-HI, F100-C-XI, F100-S-HI, F100-S-XI	No

‌

Restrictions and guidelines: Port mirroring configuration

You cannot assign a fixed interface and an interface on an interface module to the same mirroring group.

Port mirroring across member devices in an IRF fabric is not supported, which means that the mirroring sources and destination must reside on the same member device.

Port mirroring is not supported on virtual interfaces.

If you configure an interface shared by multiple contexts as a source port, traffic of the source port will be sent to the monitor port without distinction of contexts.

When configuring a mirroring group, first configure the monitor port and then configure the source ports.

When one port mirroring group is configured to monitor the outbound or bidirectional traffic of source ports, the other mirroring group must be configured to monitor the incoming traffic of source ports.

A mirroring group can be configured with one monitor port and multiple source ports. A monitor port or source port of a mirroring group cannot be configured as the source port or monitor port of another mirroring group.

Configuring local port mirroring

Restrictions and guidelines for local port mirroring configuration

A local mirroring group takes effect only after it is configured with the monitor port and mirroring sources.

Local port mirroring tasks at a glance

To configure local port mirroring, perform the following tasks:

1.     Creating a local mirroring group

2.     Configuring mirroring sources

3.     Configuring the monitor port

Creating a local mirroring group

1.     Enter system view.

system-view

2.     Create a local mirroring group.

mirroring-group group-id local

Configuring mirroring sources

Restrictions and guidelines for mirroring source configuration

When you configure source ports for a local mirroring group, follow these restrictions and guidelines:

·     A mirroring group can contain multiple source ports.

·     A port can act as a source port for multiple mirroring groups.

·     A source port cannot be configured as a monitor port.

Configuring source ports

·     Configure source ports in system view.

a.     Enter system view.

system-view

b.     Configure source ports for a local mirroring group.

mirroring-group group-id mirroring-port interface-list { both | inbound | outbound }

By default, no source port is configured for a local mirroring group.

·     Configure source ports in interface view.

a.     Enter system view.

system-view

b.     Enter interface view.

interface interface-type interface-number

c.     Configure the port as a source port for a local mirroring group.

mirroring-group group-id mirroring-port { both | inbound | outbound }

By default, a port does not act as a source port for any local mirroring groups.

Configuring the monitor port

Restrictions and guidelines

Do not enable the spanning tree feature on the monitor port.

Only one monitor port can be specified for a local mirroring group.

Use a monitor port only for port mirroring, so the data monitoring device receives only the mirrored traffic.

Procedure

·     Configure the monitor port in system view.

a.     Enter system view.

system-view

b.     Configure the monitor port for a local mirroring group.

mirroring-group group-id monitor-port interface-type interface-number

By default, no monitor port is configured for a local mirroring group.

·     Configure the monitor port in interface view.

a.     Enter system view.

system-view

b.     Enter interface view.

interface interface-type interface-number

c.     Configure the port as the monitor port for a mirroring group.

mirroring-group group-id monitor-port

By default, a port does not act as the monitor port for any local mirroring groups.

Display and maintenance commands for port mirroring

Execute display commands in any view.

 

Task	Command
Display mirroring group information.	display mirroring-group { group-id | all | local }

‌