Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Announcement: Try the Ask AI chatbot for answers to your technical questions about Juniper products and solutions.

close
header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
Network Management and Monitoring Guide
Table of Contents Expand all
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

Troubleshooting Port Mirroring

date_range 28-Nov-23

Troubleshooting Port Mirroring

Egress Port Mirroring with VLAN Translation

Problem

Description

If you create a port-mirroring configuration that mirrors customer VLAN (CVLAN) traffic on egress and the traffic undergoes VLAN translation before being mirrored, the VLAN translation does not apply to the mirrored packets. That is, the mirrored packets retain the service VLAN (SVLAN) tag that should be replaced by the CVLAN tag on egress. The original packets are unaffected—on these packets VLAN translation works properly, and the SVLAN tag is replaced with the CVLAN tag on egress.

Solution

This is expected behavior.

Egress Port Mirroring with Private VLANs

Problem

Description

If you create a port-mirroring configuration that mirrors private VLAN (PVLAN) traffic on egress, the mirrored traffic (the traffic that is sent to the analyzer system) has the VLAN tag of the ingress VLAN instead of the egress VLAN. For example, assume the following PVLAN configuration:

  • Promiscuous trunk port that carries primary VLANs pvlan100 and pvlan400.

  • Isolated access port that carries secondary VLAN isolated200. This VLAN is a member of primary VLAN pvlan100.

  • Community port that carries secondary VLAN comm300. This VLAN is also a member of primary VLAN pvlan100.

  • Output interface (monitor interface) that connects to the analyzer system. This interface forwards the mirrored traffic to the analyzer.

If a packet for pvlan100 enters on the promiscuous trunk port and exits on the isolated access port, the original packet is untagged on egress because it is exiting on an access port. However, the mirror copy retains the tag for pvlan100 when it is sent to the analyzer.

Here is another example: If a packet for comm300 ingresses on the community port and egresses on the promiscuous trunk port, the original packet carries the tag for pvlan100 on egress, as expected. However, the mirrored copy retains the tag for comm300 when it is sent to the analyzer.

Solution

This is expected behavior.

Troubleshooting Port Mirroring Configuration Error Messages

Troubleshooting issues with port mirroring on EX Series switches:

An Analyzer Configuration Returns a “Multiple interfaces cannot be configured as a member of Analyzer output VLAN” Error Message

Problem

Description

In an analyzer configuration, if the VLAN to which mirrored traffic is sent contains more than one member interface, the following error message is displayed in the CLI when you commit the analyzer configuration and the commit fails:

content_copy zoom_out_map
Multiple interfaces cannot be configured as a member of Analyzer output VLAN <vlan name>

Solution

You must direct the mirrored traffic to a VLAN that has a single member interface. You can do this by completing either of these tasks:

  • Reconfigure the existing VLAN to contain a single member interface. You can choose this method if you want to use the existing VLAN.

  • Create a new VLAN with a single member interface and associate the VLAN with the analyzer.

To reconfigure the existing VLAN to contain only one member interface:

  1. Remove member interfaces from the VLAN repeatedly by using either the delete vlan command or the delete interface command until the VLAN contains a single member interface:

    • content_copy zoom_out_map
      [edit]
      user@switch# delete vlan vlan-id interface interface-name
    • content_copy zoom_out_map
      [edit]
      user@switch# delete interface interface-name unit 0 family family-name vlan member vlan-id
  2. (Optional) Confirm that the VLAN contains only one interface:

    content_copy zoom_out_map
    [edit]
    user@switch# show vlans vlan-name

    The output for this command must display only one interface.

To create a new VLAN with a single member interface:

  1. Configure a VLAN to carry the mirrored traffic:

    content_copy zoom_out_map
    [edit]
    user@switch# set vlans vlan-name
  2. Associate an interface with the VLAN:

    content_copy zoom_out_map
    [edit]
    user@switch# set interfaces interface-name unit logical-unit-number family family-name vlan members vlan-name
    
  3. Associate the VLAN with the analyzer:

    content_copy zoom_out_map
    [edit ethernet-switching-options]
    user@switch# set analyzer analyzer-name output vlan vlan-name
footer-navigation