Table 47: Commands Made Visible By The Mirror-Enable Command - Juniper POLICY MANAGEMENT - CONFIGURATION GUIDE V11.1.X Configuration Manual

command. Authorized users can then issue the mirror-enable command, making
the packet mirroring commands visible. However, the commands are still hidden
from unauthorized users. Table 47 on page 227 lists the commands whose visibility
is controlled by the mirror-enable command.

Table 47: Commands Made Visible by the mirror-enable Command

ip policy { secure-input |
secure-output }
show ip interface (packet mirroring
information)
clear mirror log
mirror acct-session-id
mirror agent-circuit-id
mirror agent-remote-id
mirror analyzer-ip-address
mirror calling-station-id
mirror dhcp-option-82
mirror disable
mirror ip-address
mirror nas-port-id
mirror trap-enable
mirror username
secure ip classifier-list
secure ip policy-list
secure l2tp policy-list
To provide increased security, the mirror-enable command must be the only
command at its access level (level 12 by default) and it also must be at a different
privilege level than the other packet mirroring commands (level 13 by default) and
other regular JUNOSe CLI commands. This separation enables you to control
authorization to the mirror-enable command and to limit the visibility of packet
Chapter 11: Configuring CLI-Based Packet Mirroring
secure ipv6 policy-list
ipv6 policy { secure-input |
secure-output }
show ipv6 interface (packet mirroring
information)
show mirror log
show mirror rules
show mirror trap
show mirror subscribers
show secure classifier-list
show secure policy-list
show snmp secure-log
show snmp trap (packet mirroring
information)
snmp-server clear secure-log
snmp-server secure-log
snmp-server enable traps
(packetMirror keyword)
snmp-server host (packetMirror
keyword)
secure ipv6 classifier-list
Enabling and Securing CLI-Based Packet Mirroring
227