Dynamically Created Secure Policies; Mirroring Mlppp Sessions - Juniper E320 Configuration Manual

JUNOSe 7.2.x Policy Management Configuration Guide

Dynamically Created Secure Policies

Mirroring MLPPP Sessions

166 !
Configuring RADIUS-Based Mirroring
You add the trigger to the RADIUS record of the user whose traffic will be mirrored.
In addition, you must include the RADIUS VSAs listed in
user's RADIUS record.
For IP mirroring, you must include both VSA 59 and 61 or neither. If you use
NOTE:
only one of these two VSAs, the configuration fails.
Table 29: RADIUS-Based Mirroring Attributes
Standard Number Attribute Name
[26-58] Mirror-Action
[26-59] Mirror-Identifier
[26-60] Analyzer-IP-Address
[26-61] Analyzer-Port-Number
A Mirror-Action setting of 2 specifies that the router does not perform any packet
mirroring–related configuration. This setting can provide additional security by
confusing unauthorized users who attempt to access packet mirroring
communication between the router and the RADIUS server.
RADIUS-based packet mirroring uses dynamically created secure policies, which are
based on the RADIUS VSAs that an authorized RADIUS administrator creates. A
policy is created when the packet mirroring action is initiated at the RADIUS server,
and then applied to the interface that is dynamically created for the user. When the
mirroring operation is disabled, the secure policy is deleted.
The E-series router creates a name for the dynamically created policies—the name
consists of the string spl followed by a hexadecimal integer, such as spl_88000008.
The name is displayed by the show secure policy-list command.
When you use RADIUS-based packet mirroring on MLPPP traffic, RADIUS
authentication and authorization is performed on the individual links. The
mirroring-related VSAs are returned with the RADIUS response. For user-initiated
mirroring, which starts when the user logs on, a RADIUS response is returned for
each successful authentication/authorization. For RADIUS-initiated mirroring of a
user who is already logged in, a single RADIUS request is sent for each link.
! If you are mirroring an L2TP session, the packet mirroring operation is enabled
or disabled on a single link that is uniquely identified by the trigger you use (the
RADIUS attributes for Acct-Session-ID or User-Name). For tunneled MLPPP, the
individual links in the MLPPP bundle are mirrored separately. The packet
mirroring configuration fails if you use the Acct-Multi-Session-ID attribute
(RADIUS attribute 50) for the configuration.
Table 29 in the mirrored
Setting
0 = disable mirroring
1 = enable mirroring
2 = no action
String (not null-terminated)
IP address of analyzer device
UDP port number of monitoring
application in analyzer device