Enabling Passive Flow Monitoring on M Series, MX Series or T Series Routers

You can monitor IPv4 traffic from another router if you have the following components installed in an M Series, MX Series, or T Series router:

• Monitoring Services, Adaptive Services, or Multiservices PICs to perform the service processing

• SONET/SDH, Fast Ethernet, or Gigabit Ethernet PICs as transit interface

On SONET/SDH interfaces, you enable passive flow monitoring by including the passive-monitor-mode statement at the [edit interfaces so-fpc/pic/port unit logical-unit-number] hierarchy level:

[edit interfaces so-fpc/pic/port unit logical-unit-number]
passive-monitor-mode;

On Asynchronous Transfer Mode (ATM), Fast Ethernet, or Gigabit Ethernet interfaces, you enable passive flow monitoring by including the passive-monitor-mode statement at the [edit interfaces interface-name] hierarchy level:

[edit interfaces interface-name]
passive-monitor-mode;

IPv6 passive monitoring is not supported on Monitoring Services PICs. You must configure port mirroring to forward the packets from the passive monitored ports to other interfaces. Interfaces configured on the following FPCs and PIC support IPv6 passive monitoring on the T640 and T1600 Series routers:

• Enhanced Scaling FPC2

• Enhanced Scaling FPC3

• Enhanced II FPC1

• Enhanced II FPC2

• Enhanced II FPC3

• Enhanced Scaling FPC4

• Enhanced Scaling FPC4.1

• 4-port 10-Gigabit Ethernet LAN/WAN PIC with XFP (supported on both WAN-PHY and LAN-PHY mode for both IPv4 and IPv6 addresses)

• Gigabit Ethernet PIC with SFP

• 10-Gigabit Ethernet PIC with XENPAK (T1600 Series router)

• SONET/SDH OC192/STM64 PIC (T1600 Series router)

• SONET/SDH OC192/STM64 PICs with XFP (T1600 Series router)

• SONET/SDH OC48c/STM16 PIC with SFP (T1600 Series router)

• SONET/SDH OC48/STM16 (Multi-Rate)

• SONET/SDH OC12/STM4 (Multi–Rate) PIC with SFP

• Type 1 SONET/SDH OC3/STM1 (Multi–Rate) PIC with SFP

To configure port mirroring, include the port-mirroring statement at the [edit forwarding-options] hierarchy level.

When you configure an interface in passive monitoring mode, the Packet Forwarding Engine silently drops packets coming from that interface and destined to the router itself. Passive monitoring mode also stops the Routing Engine from transmitting any packet from that interface. Packets received from the monitored interface can be forwarded to monitoring interfaces. If you include the passive-monitor-mode statement in the configuration:

• The ATM interface is always up, and the interface does not receive or transmit incoming control packets, such as Operation, Administration, and Maintenance (OAM) and Interim Local Management Interface (ILMI) cells.

• The SONET/SDH interface does not send keepalives or alarms and does not participate actively on the network.

• Gigabit and Fast Ethernet interfaces can support both per-port passive monitoring and per-VLAN passive monitoring. The destination MAC filter on the receive port of the Ethernet interfaces is disabled.

• Ethernet encapsulation options are not allowed.

• Ethernet interfaces do not support the stacked-vlan-tagging statement for both IPv4 and IPv6 packets in passive monitoring mode.

On monitoring services interfaces, you enable passive flow monitoring by including the family statement at the [edit interfaces interface-name unit logical-unit-number] hierarchy level, specifying the inet option:

[edit interfaces interface-name unit logical-unit-number]
family inet;

For the monitoring services interface, you can configure multiservice physical interface properties. For more information, see Configuring Flow-Monitoring Interfaces.

For conformity with the cflowd record structure, you must include the receive-options-packets and receive-ttl-exceeded statements at the [edit interfaces interface-name unit logical-unit-number family inet] hierarchy level:

[edit interfaces interface-name unit logical-unit-number family inet]
receive-options-packets;
receive-ttl-exceeded;

[edit protocols mpls interface interface-name label-map]
default-route {
    (next-hop (address | interface-name | address/interface-name)) | (reject | discard);
    (pop | (swap <out-label>);
    class-of-service value;
    preference preference;
    type type;
}

[edit interfaces interface-name (atm-options | fastether-options | gigether-options | sonet-options) mpls]
pop-all-labels {
    required-depth [ numbers ];
}

[edit interfaces interface-name (atm-options | fastether-options | gigether-options | sonet-options) mpls pop-all-labels]
required-depth [ numbers ];

[edit firewall]
family inet {
    filter input-monitoring-filter {
        term def {
            then {
                count counter;
                accept;
            }
        }
    }
}
[edit interfaces]
ge-0/0/0 {
    passive-monitor-mode;
    gigether-options {
        mpls {
            pop-all-labels;
        }
    }
    unit 0 {
        family inet {
            filter {
                input input-monitoring-filter;
            }
        }
    }
}
fe-0/1/0 {
    passive-monitor-mode;
    vlan-tagging;
    fastether-options {
        mpls {
            pop-all-labels required-depth [ 1 2 ];
        }
    }
    unit 0 {
        vlan-id 100;
        family inet {
            filter {
                input input-monitoring-filter;
            }
        }
    }
}
mo-1/0/0 {
    unit 0 {
        family inet {
            receive-options-packets;
            receive-ttl-exceeded;
        }
    }
    unit 1 {
        family inet;
    }
}
[edit forwarding-options]
monitoring mon1 {
    family inet {
        output {
            export-format cflowd-version-5;
            cflowd 192.0.2.2 port 2055;
            interface mo-1/0/0.0 {
                source-address 192.0.2.1;
            }
        }
    }
}
[edit routing-instances]
monitoring-vrf {
    instance-type vrf;
    interface ge-0/0/0.0;
    interface fe-0/1/0.0;
    interface mo-1/0/0.1;
    route-distinguisher 68:1;
    vrf-import monitoring-vrf-import;
    vrf-export monitoring-vrf-export;
    routing-options {
        static {
            route 0.0.0.0/0 next-hop mo-1/0/0.1;
        }
    }
}
[edit policy-options]
policy-statement monitoring-vrf-import {
    then {
        reject;
    }
}
policy-statement monitoring-vrf-export {
    then {
        reject;
    }
}

[edit interfaces]
xe-0/1/0 {
    passive-monitor-mode;
    unit 0 {
        family inet6 {
            filter {
                input port-mirror6;
            }
            address 2001:db8::1/128;
        }
    }
}
    xe-0/1/2 {
        passive-monitor-mode;
        vlan-tagging;
        unit 0 {
            vlan-id 100;
            family inet6 {
                filter {
                    input port-mirror6;
                }
            }
        }
    }
    xe-0/1/1 {
        unit 0 {
            family inet6 {
                address 2001:db8::1/128;
            }
        }
        
    }
[edit firewall]
family inet6 {
    filter port-mirror6 {
        term term2 {
            then {
                count count_pm;
                port-mirror;
                accept;
            }
        }
    }
}
[edit forwarding options]
port-mirroring {
    input {
        rate 1;
    }
    family inet6 {
        output {
            interface xe-0/1/1.0 {
                next-hop 2001:db8::3;
            }
            no-filter-check;
        }
    }
}