Configuring Cli-Based Packet Mirroring; Cli-Based Packet Mirroring Overview - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE 2010-10-04 Configuration Manual

CHAPTER 11

Configuring CLI-Based Packet Mirroring

CLI-Based Packet Mirroring Overview

Copyright © 2010, Juniper Networks, Inc.
Packet mirroring enables you to send a copy of a packet to an external host for analysis.
Packet mirroring has many uses, including traffic debugging and troubleshooting user
networking problems.
This chapter contains the following sections:
CLI-Based Packet Mirroring Overview on page 219
Enabling and Securing CLI-Based Packet Mirroring on page 220
Reloading a CLI-Based Packet-Mirroring Configuration on page 222
Using TACACS+ and Vty Access Lists to Secure Packet Mirroring on page 222
Using Vty Access Lists to Secure Packet Mirroring on page 222
CLI-Based Packet Mirroring Sequence of Events on page 223
Configuring CLI-Based Mirroring on page 224
Configuring Triggers for CLI-Based Mirroring on page 226
Configuring the Analyzer Device on page 227
Configuring the E Series Router on page 228
Example: Configuring CLI-Based Interface-Specific Mirroring on page 228
Example: Configuring CLI-Based User-Specific Mirroring on page 229
The JunosE Software enables you to use CLI commands to configure and manage packet
mirroring on specific static IP interfaces, or for a specific user. You use CLI commands to
create a secure policy that specifies the analyzer device and how the mirrored traffic is
treated.
When you mirror an interface, you can replicate ingress and egress traffic on the interface
(traffic entering or exiting the E Series router through that interface). When you mirror a
user, you can replicate all traffic to or from the user.
In both interface-specific and user-specific mirroring, the original traffic is forwarded to
its intended destination as usual, while the replicated copy of the traffic is forwarded to
an analyzer interface on the E Series router. The analyzer interface then directs the
mirrored traffic to the specified analyzer device for analysis.
219