3. Configure the secure L2TP policy that forwards the mirrored traffic to the
4. Configure packet mirroring for the subscriber identified by username
5. Verify the packet mirroring configuration.
host1#show mirror subscribers
Subscriber ID
------------------
lac:jwbooth@isptheatre.com
6. Verify the configuration of the secure L2TP policy.
host1#show secure policy-list name l2tp_toMirrorHQ
Secure L2TP Policy l2tp_toMirrorHQ
analyzer-udp-port 6500 mirror-id 1 session-id 1
Commands and Guidelines
This section lists the commands you use to configure CLI-based packet mirroring.
classifier-group
!
!
analyzer device at 192.168.99.2, port 6500.
hosts1(config)#secure l2tp policy-list l2tp_toMirrorHQ
host1(config-policy-list)#classifier-group *
host1(config-policy-list-classifier-group)#mirror analyzer-ip-address 192.168.99.2
analyzer-virtual-router default analyzer-udp-port 6500 mirror-identifier 1
session-identifier 1
jwbooth@isptheatre.com and associate the secure policy with the user.
host1(config)#virtual-router lac
host1:lac(config)#mirror username jwbooth@isptheatre.com l2tp
secure-policy-list l2tp_toMirrorHQ
Now, when subscriber jwbooth@isptheatre.com logs in, the packet mirroring
session starts and the subscriber's replicated traffic is sent through the secure
IPSec tunnel to the remote analyzer device.
Subscriber ID
Method
------------------
username
Administrative state: enable
Reference count:
2
Classifier control list: *
mirror analyzer-ip-address 192.168.99.2 analyzer-virtual-router default
Referenced by interface(s):
TUNNEL l2tp:5/1/5
secure-input policy
TUNNEL l2tp:5/1/5
secure-output policy
Use to create a classifier group for a secure policy list and enter Classifier Group
Configuration mode.
In Classifier Group Configuration mode, you configure the mirror action for the
classifier group.
Secure Policy
Secure Policy List
Type
-------------
------------------
l2tp
l2tp_toMirrorHQ
Policy Table
------ -----
Configuring CLI-Based Packet Mirroring
Chapter 6: Packet Mirroring
Sessions
Mirrored
--------
1
!
159