Configuring Port Mirroring Instances
Layer 2 Port Mirroring Global Instance
On an MX Series router and on an EX Series switch, you can configure a set of port-mirroring properties that implicitly apply to packets received on all ports in the router (or switch) chassis. This set of port-mirroring properties is the global instance of Layer 2 port mirroring for the router or switch.
Within the global instance configuration, you can specify a set of mirror destination properties for each packet address family supported by Layer 2 port mirroring.
For a general description of Layer 2 port-mirroring properties, see Understanding Layer 2 Port Mirroring Properties. For a comparison of the types of Layer 2 port mirroring available on an MX Series router and on an EX Series switch, see Application of Layer 2 Port Mirroring Types.
Configuring the Global Instance of Layer 2 Port Mirroring
On an MX Series router and on an EX Series switch, you can configure a set of Layer 2 port-mirroring properties that implicitly apply to packets received on all ports in the router (or switch) chassis.
To configure the global instance of Layer 2 port mirroring on an MX Series router and on an EX Series switch:
Layer 2 Port Mirroring Named Instances
This topic describes the following information:
- Layer 2 Port Mirroring Named Instances Overview
- Mirroring at Ports Grouped at the FPC Level
- Mirroring at Ports Grouped at the PIC Level
- Mirroring at a Group of Ports Bound to Multiple Named Instances
Layer 2 Port Mirroring Named Instances Overview
On an MX Series router and on an EX Series switch, you can define a set of port-mirroring properties that you can explicitly bind to physical ports on the router or switch. This set of port mirroring properties is known as a named instance of Layer 2 port mirroring.
You can bind a named instance of Layer 2 port mirroring to physical ports associated with an MX Series router’s or an EX Series switch’s Packet Forwarding Engine components at different levels of the router (or switch) chassis:
At the FPC level—You can bind a named instance to the physical ports associated with a specific Dense Port Concentrator (DPC) or to the physical ports associated with a specific Flexible Port Concentrator (FPC).
At the PIC level—You can bind a named instance of port mirroring to a specific Packet Forwarding Engine (on a specific DPC) or to a specific PIC.
MX Series routers support DPCs as well as FPCs and PICs. Unlike FPCs, DPCs do not support PICs. In the Junos OS CLI, however, you use FPC and PIC syntax to configure or display information about DPCs and the Packet Forwarding Engines on the DPCs.
The following points summarize the behavior of Layer 2 port mirroring based on named instances:
The scope of packet selection is determined by the target of the binding—At the ports (or port) bound to a named instance of Layer 2 port mirroring, the router or switch selects input packets according to the packet-selection properties in the named instance.
The destination of a selected packet is determined by the packet address family—Of the packets selected, the router or switch mirrors only the packets belonging to an address family for which the named instance of Layer 2 port mirroring specifies a set of mirror destination properties. In a Layer 2 environment, MX Series routers and EX Series switches support port mirroring of VPLS (
family ethernet-switching
orfamily vpls
) traffic and Layer 2 VPN traffic withfamily ccc
.
For a general description of Layer 2 port-mirroring properties, see Understanding Layer 2 Port Mirroring Properties. For a comparison of the types of Layer 2 port mirroring available on an MX Series router and on an EX Series switch, see Application of Layer 2 Port Mirroring Types.
Mirroring at Ports Grouped at the FPC Level
On an MX Series router and on an EX Series switch, you can bind a named instance of Layer 2 port mirroring to a specific DPC or FPC installed in the router (or switch) chassis. The port mirroring properties in the instance are applied to all Packet Forwarding Engines (and their associated ports) on the specified DPC or to all PICs (and their associated ports) installed in the specified FPC. Port mirroring properties that are bound to a DPC or FPC override any port-mirroring properties bound at the global level or the MX Series router (or switch) chassis.
Mirroring at Ports Grouped at the PIC Level
On an MX Series router and on an EX Series switch, you can bind a named instance of Layer 2 port mirroring to a specific Packet Forwarding Engine or PIC. The port-mirroring properties in that instance are applied to all ports associated with the specified Packet Forwarding Engine or PIC. Port-mirroring properties that are bound to a Packet Forwarding Engine or PIC override any port-mirroring properties bound at the DPC or FPC that contains them.
For MX960 routers, there is a one-to-one mapping of Packet Forwarding Engines to Ethernet ports. Therefore, on MX960 routers only, you can configure port-specific bindings of port-mirroring instances.
Mirroring at a Group of Ports Bound to Multiple Named Instances
On an MX Series router and on an EX Series switch, you can apply up to two named instances of Layer 2 port mirroring to the same group of ports within the router (or switch) chassis. By applying two different port-mirroring instances to the same DPC, FPC, Packet Forwarding Engine, or PIC, you can bind two distinct Layer 2 port mirroring specifications to a single group of ports.
You can configure only one global instance of Layer 2 port mirroring on an MX Series router and on an EX Series switch.
You can configure more than two port mirroring instances for each FPC by configuring inline port mirroring. For information on inline port mirroring, see Configuring Inline Port Mirroring.
Defining a Named Instance of Layer 2 Port Mirroring
On an MX Series router and on an EX Series switch, you can define a set of Layer 2 port-mirroring properties that you can bind to a particular Packet Forwarding Engine (at the PIC level of the router or switch chassis) or to a group of Packet Forwarding Engines (at the DPC or FPC level of the chassis).
To define a named instance of Layer 2 port mirroring on an MX Series router or on an EX Series switch:
Disabling Layer 2 Port Mirroring Instances
You can disable the global instance of Layer 2 port mirroring, a particular named instance, or all instances of port mirroring:
To disable the global instance of Layer 2 port mirroring, include the
disable
statement at the[edit forwarding-options port-mirroring]
hierarchy level:[edit] forwarding-options { port-mirroring { disable; Disables the global instance of Layer 2 port mirroring. ...global-instance-of-layer-2-port-mirroring-configuration... } }
To disable the definition of a particular named instance of Layer 2 port mirroring, include the
disable
statement at the[edit forwarding-options port-mirroring instance instance-name]
hierarchy level:[edit] forwarding-options { port-mirroring { ...optional-configuration-of-the-global-instance-of-layer-2-port-mirroring... instance { port-mirroring-instance-name { disable; Disables this named instance of Layer 2 port mirroring. ...definition-of-a-named-instance-of-layer-2-port-mirroring... } } } }
To disable the global instance and all named instances of Layer 2 port mirroring, include the
disable-all-instances
statement at the[edit forwarding-options port-mirroring]
hierarchy level:[edit] forwarding-options { port-mirroring { disable-all-instances; Disables all instances of Layer 2 port mirroring. ...optional-configuration-of-the-global-instance-of-layer-2-port-mirroring... instance { port-mirroring-instance-name { ...definition-of-a-named-instance-of-layer-2-port-mirroring... } } } }
Configuring Inline Port Mirroring
Inline port mirroring provides you with the ability to specify
instances that are not bound to the flexible PIC concentrator (FPC)
in the firewall filter then port-mirror-instance
action.
This way, you are not limited to only two port-mirror instances per
FPC. Inline port mirroring decouples the port-mirror destination from
the input parameters like rate
. While the input parameters
are programmed in the switch interface board, the next-hop destination
of the mirrored packet is available in the packet itself. Inline port
mirroring is supported only on Trio-based modular port concentrators
(MPCs).
Using inline port mirroring, a port-mirror instance will have an option to inherit input parameters from another instance that specifies it, as shown in the following CLI configuration example:
instance pm2 { + input-parameters-instance pm1; family inet { output { interface ge-1/2/3.0 { next-hop 192.0.2.10; } } } }
Multiple levels of inheritance are not allowed. One instance can be referred by multiple instances. An instance can refer to another instance that is defined before it. Forward references are not allowed and an instance cannot refer to itself, doing so will cause an error during configuration parsing.
The user can specify an instance that is not bound to the FPC in the firewall filter. The specified filter should inherit one of the two instances that have been bound to the FPC. If it does not, the packet is not marked for port-mirroring. If it does, then the packet will be sampled using the input parameters specified by the referred instance but the copy will be sent to the its own destination.