Conflicts Between Cli-Based And Radius-Based Configurations; Understanding The Prepended Header - Juniper E320 Configuration Manual

JUNOSe 7.2.x Policy Management Configuration Guide

Conflicts Between CLI-Based and RADIUS-Based Configurations

Understanding the Prepended Header

174 !
Conflicts Between CLI-Based and RADIUS-Based Configurations
The JUNOSe software gives you a great deal of flexibility in creating your packet
mirroring environment by supporting both the CLI-based and the RADIUS-based
configuration methods. However, a conflict might occur when you use both
methods. For example, you might have both a CLI-based session and a
RADIUS-based session for the same subscriber, each session using a unique secure
policy list.
To avoid potential conflicts when both CLI-based and RADIUS-based configurations
exist for a subscriber, the JUNOSe software uses the following rules to determine
which configuration to use:
When a user logs in—The RADIUS-based configuration is always used
!
! When the user is already logged in—The new configuration always replaces the
existing configuration, regardless of creation method.
During a packet mirroring session, the router prepends a special UDP/IP header to
each mirrored packet that is sent to the analyzer port. This prepended header is
created by the policy-mirroring action, and is used for demultiplexing at the
analyzer to sort through the multiple mirrored streams that arrive from different
sources.
All mirrored L2TP session packets are prepended with UDP/IP header. However, for
IP traffic mirroring, the prepend header is optional; the header is added if the
mirroring-related VSAs (VSAs 59 and 61) are included in the RADIUS message. For
CLI-based mirroring, the analyzer-udp-port keyword of the mirror
analyzer-ip-address command creates the same information contained in the two
VSAs. If you do not include the VSAs or the analyzer-udp-port keyword, an IP
mirroring action is indicated, and the prepend header is not used.
For IP mirroring, both VSA 26-59 and 26-61 or neither must be included. If
NOTE:
only one of the VSAs is used, the configuration fails.
Figure 11 shows the structure of the prepended header. The values in parentheses
indicate the fixed value for individual fields. For fields that do not have a fixed value
listed, the value is dynamically created for each mirrored packet.
page 175 lists the fields in the prepended header and indicates the values and field
length.
Table 33 on