Policy Based Mirroring - OmniSwitch os6900 Network Configuration Manual

Configuring QoS

Policy Based Mirroring

A mirroring policy sends a copy of ingress, egress, or both ingress and egress packets that match the
policy condition to a specific port. This type of policy can use any condition; the mirror policy action
determines the type of traffic to mirror and the port on which the mirrored traffic is received.
The policy action mirror
example, the following policy mirrors ingress packets to port 1/10:
-> policy condition c1 source ip 192.168.20.1
-> policy action a1 mirror ingress 1/10
-> policy rule r1 condition c1 action a1
-> qos apply
When the above rule is activated, any flows coming into the switch from source IP address 192.168.20.1
are mirrored to port 1/10. It is also possible to combine the MTP action with other actions. For example:
-> policy condition c1 source ip 192.168.20.1
-> policy action a1 mirror ingress 1/10 disposition drop
-> policy rule r1 condition c1 action a1
-> qos apply
This policy rule example combines the MTP action with the drop action. As a result, this rule drops
ingress traffic with a source IP of 192.168.20.1, but the mirrored traffic from this source is not dropped
and is forwarded to port 1/10.
Note the following regarding the use and configuration of mirroring policies:
•
Only one policy-based MTP session is supported at any given time. As a result, all mirroring policies
must specify the same destination port.
•
In addition to one policy-based MTP session, the switch can support one port-based mirroring session,
one remote port mirroring session, and one port monitoring session all running at the same time.
•
Policy based mirroring and the port-based mirroring feature can run simultaneously on the same port.
•
Rule precedence is applied to all mirroring policies that are configured for the same switch ASIC. If
traffic matches a mirror rule on one ASIC with a lower precedence than a non-mirroring rule on a
different ASIC, the traffic is mirrored in addition to the actions specified by the higher precedence rule.
ICMP Policy Example
Policies can be configured for ICMP on a global basis on the switch. ICMP policies can be used for
security (for example, to drop traffic from the ICMP blaster virus).
In the following example, a condition called icmpCondition is created with no other condition
parameters:
-> policy condition icmpCondition ip protocol 1
-> policy action icmpAction disposition deny
-> policy rule icmpRule condition icmpCondition action icmpAction
This policy (icmpRule) drops all ICMP traffic. To limit the dropped traffic to ICMP echo requests (pings)
and/or replies, use the
-> policy condition echo icmptype 8
-> policy condition reply icmptype 0
OmniSwitch AOS Release 7 Network Configuration Guide
command is used to configure mirror-to-port (MTP) action for the policy. For
policy condition icmptype to specify the appropriate condition. For example,
June 2013
Policy Applications
page 25-77