Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring Mirroring for Remote Monitoring of Employee Resource Use on EX4300 Switches

Note: This example uses Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does not support ELS, see Example: Configuring Mirroring for Remote Monitoring of Employee Resource Use on EX4300 Switches. For ELS details see: Getting Started with Enhanced Layer 2 Software.

EX4300 switches enable you to configure mirroring to send copies of packets to either a local interface for local monitoring or to a VLAN for remote monitoring. You can use mirroring to copy these packets:

• Packets entering or exiting a port
• Packets entering a VLAN on EX4300 switches

You can analyze the mirrored traffic by using a protocol analyzer application running on a remote monitoring station if you are sending mirrored traffic to an analyzer VLAN.

This topic includes two related examples that describe how to mirror traffic entering ports on the switch to the remote-analyzer VLAN so that you can perform analysis from a remote monitoring station. The first example shows how to mirror all traffic entering the ports connected to employee computers. The second example shows the same scenario but includes a filter to mirror only the employee traffic going to the Web.

Best Practice: Mirror only necessary packets to reduce potential performance impact. We recommend that you: Disable your configured mirroring sessions when you are not using them. Specify individual interfaces as input to analyzers rather than specifying all interfaces as input. Limit the amount of mirrored traffic by using firewall filters.

This example describes how to configure remote mirroring:

Requirements

• Junos OS Release 13.2X50-D10 or later for EX Series switches
• An EX4300 switch connected to another EX4300 switch

The diagram shows an EX4300 Virtual Chassis connected to an EX4300 destination switch.

Before you configure remote mirroring, be sure that:

• You have an understanding of mirroring concepts.
• The interfaces that the analyzer will use as input interfaces have been configured on the switch.

Overview and Topology

This topic includes two related examples that describe how to configure mirroring to the remote-analyzer VLAN so that analysis can be performed from a remote monitoring station. The first example shows how to configure a switch to mirror all traffic from employee computers. The second example shows the same scenario, but the setup includes a filter to mirror only the employee traffic going to the Web.

Figure 1 shows the network topology for both these example scenarios.

Figure 1: Remote Mirroring Network Topology Example

1. Interface ge-0/0/0 is a Layer 2 interface, and interface ge-0/0/1 is a Layer 3 interface (both interfaces on the source switch) that serve as connections for employee computers.
2. Interface ge-0/0/10 is a Layer 2 interface that connects the source switch to the destination switch.
3. Interface ge-0/0/5 is a Layer 2 interface that connects the destination switch to the remote monitoring station.
4. VLAN remote-analyzer is configured on all switches in the topology to carry the mirrored traffic.

Mirroring All Employee Traffic for Remote Analysis

To configure an analyzer for remote traffic analysis for all incoming and outgoing employee traffic, perform these tasks:

CLI Quick Configuration

To quickly configure an analyzer for remote traffic analysis for incoming and outgoing employee traffic, copy the following commands and paste them into the switch terminal window:

• Copy and paste the following commands in the source switch terminal window:
  [edit]

  set vlans remote-analyzer vlan-id 999

  set interfaces ge-0/0/10 unit 0 family ethernet-switching interface-mode trunk

  set interfaces ge-0/0/10 unit 0 family ethernet-switching vlan members 999

  set forwarding-options analyzer employee-monitor input ingress interface ge-0/0/0.0

  set forwarding-options analyzer employee-monitor input ingress interface ge-0/0/1.0

  set forwarding-options analyzer employee-monitor input egress interface ge-0/0/0.0

  set forwarding-options analyzer employee-monitor input egress interface ge-0/0/1.0

  set forwarding-options analyzer employee-monitor output vlan remote-analyzer
• Copy and paste the following commands in the destination switch terminal window:
  [edit]

  set vlans remote-analyzer vlan-id 999

  set interfaces ge-0/0/10 unit 0 family ethernet-switching interface-mode trunk

  set interfaces ge-0/0/10 unit 0 family ethernet-switching vlan members 999

  set interfaces ge-0/0/5 unit 0 family ethernet-switching interface-mode trunk

  set forwarding-options analyzer employee-monitor input ingress vlan remote-analyzer

  set forwarding-options analyzer employee-monitor output interface ge-0/0/5.0

Step-by-Step Procedure

1. On the source switch:
   • Configure the VLAN ID for the remote-analyzer VLAN:
     [edit vlans]
user@switch# set remote-analyzer vlan-id 999
   • Configure the interface on the network port connected to the destination switch for trunk mode and associate it with the remote-analyzer VLAN:
     [edit interfaces]
user@switch# set ge-0/0/10 unit 0 family ethernet-switching interface-mode trunk
user@switch# set ge-0/0/10 unit 0 family ethernet-switching vlan members 999
   • Configure the employee-monitor analyzer:
     [edit forwarding-options]
user@switch# set analyzer employee-monitor input ingress interface ge-0/0/0.0
user@switch# set analyzer employee-monitor input ingress interface ge-0/0/1.0
user@switch# set instance employee-monitor input egress interface ge-0/0/0.0
user@switch# set analyzer employee-monitor input egress interface ge-0/0/1.0
user@switch# set analyzer employee-monitor output vlan remote-analyzer


2. On the destination switch:
   • Configure the VLAN ID for the remote-analyzer VLAN:
     [edit vlans]
user@switch# set remote-analyzer vlan-id 999
   • Configure the interface on the destination switch for trunk mode and associate it with the remote-analyzer VLAN:
     [edit interfaces]
user@switch# set ge-0/0/10 unit 0 family ethernet-switching interface-mode trunk
user@switch# set ge-0/0/10 unit 0 family ethernet-switching vlan members 999
   • Configure the interface connected to the destination switch for trunk mode:
     [edit interfaces]
user@switch# set ge-0/0/5 unit 0 family ethernet-switching interface-mode trunk
   • Configure the employee-monitor analyzer:
     [edit forwarding-options]
user@switch# set analyzer employee-monitor input ingress vlan remote-analyzer
user@switch# set analyzer employee-monitor output interface ge-0/0/5.0

Results

Check the results of the configuration on the source switch:

Check the results of the configuration on the destination switch:

Mirroring Employee-to-Web Traffic for Remote Analysis

To configure port mirroring for remote traffic analysis of employee- to- Web traffic, perform these tasks:

CLI Quick Configuration

To quickly configure port mirroring to mirror employee traffic to the external Web, copy the following commands and paste them into the switch terminal window:

• Copy and paste the following commands in the source switch terminal window:
  [edit]

  set forwarding-options port-mirroring instance employee-web-monitor output vlan 999

  set vlans remote-analyzer vlan-id 999

  set interfaces ge-0/0/10 unit 0 family ethernet-switching port mode trunk

  set interfaces ge-0/0/10 unit 0 family ethernet-switching vlan members 999

  set firewall family ethernet-switching filter watch-employee term employee-to-corp from destination-address 192.0.2.16/28

  set firewall family ethernet-switching filter watch-employee term employee-to-corp from source-address 192.0.2.16/28

  set firewall family ethernet-switching filter watch-employee term employee-to-corp then accept

  set firewall family ethernet-switching filter watch-employee term employee-to-web from destination-port 80

  set firewall family ethernet-switching filter watch-employee term employee-to-web then port-mirror-instance employee-web-monitor

  set interfaces ge-0/0/0 unit 0 family ethernet-switching filter input watch-employee

  set interfaces ge-0/0/1 unit 0 family ethernet-switching filter input watch-employee
• Copy and paste the following commands in the destination switch terminal window:
  [edit]

  set vlans remote-analyzer vlan-id 999

  set interfaces ge-0/0/10 unit 0 family ethernet-switching interface-mode trunk

  set interfaces ge-0/0/10 unit 0 family ethernet-switching vlan members 999

  set interfaces ge-0/0/5 unit 0 family ethernet-switching interface-mode trunk

  set forwarding-options analyzer employee-web-monitor input ingress vlan remote-analyzer

  set forwarding-options analyzer employee-web-monitor output interface ge-0/0/5.0

Step-by-Step Procedure

1. On the source switch:
   • Configure the employee-web-monitor port mirroring instance:
     [edit ]
user@switch# set interfaces ge-0/0/10 unit 0 family ethernet-switching port mode trunk
user@switch# set forwarding-options port-mirroring instance employee-web-monitor output vlan 999
   • Configure the VLAN ID for the remote-analyzer VLAN:
     [edit vlans]
user@switch# set remote-analyzer vlan-id 999
   • Configure the interface to associate it with the remote-analyzer VLAN:
     [edit interfaces]
user@switch# set ge-0/0/10 unit 0 family ethernet-switching vlan members 999

   • Configure the firewall filter called watch-employee:
     [edit firewall family ethernet-switching]
user@switch# set filter (Firewall Filters) watch-employee term employee-to-corp from destination-address 192.0.2.16/28
user@switch# set filter watch-employee term employee-to-corp from source-address 192.0.2.16/28
user@switch# set filter watch-employee term employee-to-corp then accept
user@switch# set filter watch-employee term employee-to-web from destination-port 80
user@switch# set filter watch-employee term employee-to-web then port-mirror-instance employee-web-monitor
   • Apply the firewall filter to the employee interfaces:
     [edit interfaces]
user@switch# set ge-0/0/0 unit 0 family ethernet-switching filter input watch-employee
user@switch# set ge-0/0/1 unit 0 family ethernet-switching filter input watch-employee
2. On the destination switch:
   • Configure the VLAN ID for the remote-analyzer VLAN:
     [edit vlans]
user@switch# set remote-analyzer vlan-id 999
   • Configure the interface on the destination switch for trunk mode and associate it with the remote-analyzer VLAN:
     [edit interfaces]
user@switch# set ge-0/0/10 unit 0 family ethernet-switching interface-mode trunk
user@switch# set ge-0/0/10 unit 0 family ethernet-switching vlan members 999
   • Configure the interface connected to the destination switch for trunk mode:
     [edit interfaces]
user@switch# set ge-0/0/5 unit 0 family ethernet-switching interface-mode trunk
   • Configure the employee-monitor analyzer:
     [edit forwarding-options port-mirroring]
user@switch# set instance employee-web-monitor input ingress vlan remote-analyzer
user@switch# set instance employee-web-monitor output interface ge-0/0/5.0

Results

Check the results of the configuration on the source switch:

Check the results of the configuration on the destination switch:

Verification

To confirm that the configuration is working properly, perform these tasks:

• Verifying That the Analyzer Has Been Correctly Created

Verifying That the Analyzer Has Been Correctly Created

Purpose

Verify that the analyzer named employee-monitor or employee-web-monitor has been created on the switch with the appropriate input interfaces and appropriate output interface.

Action

  Analyzer name                    : employee-monitor
  Mirror rate                     	   : 1
  Maximum packet length        : 0
  State                           	   : up
  Ingress monitored interfaces     : ge-0/0/0.0
  Ingress monitored interfaces     : ge-0/0/1.0
  Egress monitored interfaces     : ge-0/0/0.0
  Egress monitored interfaces     : ge-0/0/1.0
  Output VLAN                        : default-switch/remote-analyzer

Meaning

This output shows that the employee-monitor instance has a ratio of 1 (mirroring every packet, the default), the maximum size of the original packet that was mirrored (0 indicates the entire packet), the state of the configuration is up (which indicates the proper state and that the analyzer is programmed, and is mirroring the traffic entering ge-0/0/0 and ge-0/0/1 and is sending the mirrored traffic to the VLAN called remote-analyzer). If the state of the output interface is down or if the output interface is not configured, the value of state will be down and the analyzer will not be programmed for mirroring.