Radius-Based Mirroring Procedure; Configuring The Radius Server; Disabling Radius-Based Mirroring - Juniper E320 Configuration Manual

JUNOSe 7.2.x Policy Management Configuration Guide

RADIUS-Based Mirroring Procedure

168 !
Configuring RADIUS-Based Mirroring
Table 31: RADIUS-Based Mirroring During Session Start
Step Description
1 The user logs on to an E-series router, requesting authentication by the RADIUS server.
A trigger in the logon request starts the packet mirroring session.
!
2 The RADIUS server authenticates the user and sends packet mirroring VSAs and any
other configured VSAs to the router.
!
The router creates a secure policy based on the VSAs and starts mirroring the user's
traffic.
3
The router sends the user's original traffic to its intended destination.
4 The router sends the mirrored traffic to analyzer device.
5 The analyzer device provides information for the requesting individual.
Table 32 indicates the sequence of steps for a packet mirroring operation that is
configured for a currently running session.
Table 32: RADIUS-Based Mirroring of Currently Running Session
Step Description
1 The user logs on to the E-series router; no mirroring action is configured.
!
2 Packet mirroring is enabled on the RADIUS server.
!
The RADIUS server sends change-of-authorization messages containing packet
mirroring VSAs to the router.
!
The router creates a secure policy based on the VSAs and starts mirroring the user's
traffic.
3 The router sends the user's original traffic to its intended destination.
4 The router sends mirrored traffic to the analyzer device.
5
The analyzer device provides information for the requesting individual.
To configure the RADIUS-based packet mirroring environment, you must
coordinate the mirroring operations of three devices in the network: the RADIUS
server, the E-series router, and the analyzer device. The configuration of the RADIUS
server and the analyzer device is described in this section for reference only. The
actual configuration procedures depend on the policies and guidelines established
by the responsible organizations.

Configuring the RADIUS Server

Table 29 lists the VSAs that are included for both types of RADIUS-based
mirroring—user-initiated (when the user logs on to start a new session), and
RADIUS-initiated (when the user is already logged in).

Disabling RADIUS-Based Mirroring

To disable mirroring, you include the RADIUS attribute (for example,
Acct-Session-ID) and set the Mirror-Action attribute to 0 in the mirrored user's
RADIUS record.