Chapter 11 Configuring Cli-Based Packet Mirroring - Juniper POLICY MANAGEMENT - CONFIGURATION GUIDE V11.1.X Configuration Manual

Chapter 11
Configuring CLI-Based Packet Mirroring
CLI-Based Packet Mirroring Overview
Packet mirroring enables you to send a copy of a packet to an external host for
analysis. Packet mirroring has many uses, including traffic debugging and
troubleshooting user networking problems.
This chapter contains the following sections:
CLI-Based Packet Mirroring Overview on page 225
Enabling and Securing CLI-Based Packet Mirroring on page 226
Reloading a CLI-Based Packet-Mirroring Configuration on page 228
Using TACACS+ and Vty Access Lists to Secure Packet Mirroring on page 228
Using Vty Access Lists to Secure Packet Mirroring on page 228
CLI-Based Packet Mirroring Sequence of Events on page 229
Configuring CLI-Based Mirroring on page 231
Configuring Triggers for CLI-Based Mirroring on page 232
Configuring the Analyzer Device on page 233
Configuring the E Series Router on page 233
Example: Configuring CLI-Based Interface-Specific Mirroring on page 234
Example: Configuring CLI-Based User-Specific Mirroring on page 235
The JUNOSe software enables you to use CLI commands to configure and manage
packet mirroring on specific static IP interfaces, or for a specific user. You use CLI
commands to create a secure policy that specifies the analyzer device and how the
mirrored traffic is treated.
When you mirror an interface, you can replicate ingress and egress traffic on the
interface (traffic entering or exiting the E Series router through that interface). When
you mirror a user, you can replicate all traffic to or from the user.
In both interface-specific and user-specific mirroring, the original traffic is forwarded
to its intended destination as usual, while the replicated copy of the traffic is forwarded
to an analyzer interface on the E Series router. The analyzer interface then directs
the mirrored traffic to the specified analyzer device for analysis.
CLI-Based Packet Mirroring Overview
225