Reloading A Cli-Based Packet Mirroring Configuration - Juniper E320 Configuration Manual

To create a secure packet mirroring environment, you use a combination of the
JUNOSe software's authorization methods and the mirror-enable command. You
configure the authorization method to control who can use the mirror-enable
command. Authorized users can then issue the mirror-enable command, making
the packet mirroring commands visible. However, the commands are still hidden
from unauthorized users. Table 24
by the mirror-enable command.
Table 24: Commands Made Visible by the mirror-enable Command
!
ip policy { secure-input | secure-output }
!
clear mirror log
!
mirror acct-session-id
!
mirror analyzer-ip-address
!
mirror calling-station-id
!
mirror disable
!
mirror ip-address
!
mirror nas-port-id
!
mirror trap-enable
!
mirror username
To provide increased security, the mirror-enable command must be the only
command at its access level (level 12 by default) and it also must be at a different
privilege level than the other packet mirroring commands (level 13 by default) and
other regular JUNOSe CLI commands. This separation enables you to control
authorization to the mirror-enable command and to limit the visibility of packet
mirroring commands. For example, if you are using TACACS+, the mirror-enable
command is the only packet mirroring command that is sent to the TACACS+
server.
The following two examples describe techniques you might use to enable and
secure your CLI-based packet mirroring environment. Example 1 uses a
combination of TACACS+ authorization and virtual terminal (vty) access lists to
secure the packet mirroring environment. Example 2 uses only vty access lists.
See JUNOSe System Basics Configuration Guide, Chapter 8, Passwords and Security
more information about access levels. See
Guide, Chapter 5, Configuring TACACS+
authorization.

Reloading a CLI-Based Packet Mirroring Configuration

You can reload your packet mirroring configuration as part of a configuration file
(.cnf) reload operation or when you run a script file (.scr) that you have saved from
the show configuration command display. When you reload a .cnf file, the packet
mirroring configuration is restored—no additional steps are required.
lists the commands whose visibility is controlled
!
secure policy-list
!
show mirror log
!
show mirror rules
!
show mirror trap
!
show mirror subscribers
!
show secure policy-list
!
show snmp trap (packet mirroring
information)
!
snmp-server secure-log
!
snmp-server enable traps (packetMirror
keyword)
!
snmp-server host (packetMirror keyword)
JUNOSe Broadband Access Configuration
for information about TACACS+
Configuring CLI-Based Packet Mirroring
Chapter 6: Packet Mirroring
for
! 153