Acl Port Mirroring; Viewing Acl Statistics - Lenovo Flex System Fabric CN4093 Application Manual

ACL Port Mirroring

Viewing ACL Statistics

© Copyright Lenovo 2015
For regular ACLs and VMaps, packets that match an ACL on a specific port can be
mirrored to another switch port for network diagnosis and monitoring.
The source port for the mirrored packets cannot be a portchannel, but may be a
member of a portchannel.
The destination port to which packets are mirrored must be a physical port.
If the ACL or VMap has an action (permit, drop, etc.) assigned, it cannot be used to
mirror packets for that ACL.
Use the following commands to add mirroring to an ACL:
 For regular ACLs:
CN4093(config)# access­control list <ACL number> mirror port <destination
port>
The ACL must be also assigned to it target ports as usual (see "Assigning
Individual ACLs to a Port" on page 100, or "Assigning ACL Groups to a Port" on
page 102).
For VMaps (see "VLAN Maps" on page

CN4093(config)# access­control vmap <VMap number> mirror port <monitor
destination port>
ACL statistics display how many packets have "hit" (matched) each ACL. Use
ACL statistics to check filter performance or to debug the ACL filter configuration.
You must enable statistics for each ACL that you wish to monitor:
CN4093(config)# access­control list <ACL number> statistics
106):
Chapter 8: Access Control Lists
103