Example: Configuring Remote Port Mirroring on PTX Routers

Remote Port Mirroring Functional Overview provides a quick summary of the protocols and technologies deployed in this example.

This example uses the context of a MPLS-based L3 VPN to demonstrate the remote port mirroring feature on PTX routers. The L3 VPN is configured to support both IPv4 and IPv6 traffic between the customer edge (CE) and provider edge (PE) routers.

Figure 1: Remote Port Mirroring

This example demonstrates two ways of mirroring CE traffic sent over the provider network:

• The first method uses a match-all filter on the PE-CE VRF interface.

• The second method demonstrates a MPLS label matching filter that is applied on the provider (P) router.

The PE1 router (R2) and the P router (R3) are the routers where remote port mirroring is configured and function as our DUTs. These routers use family any firewall filters to match on select traffic for port mirroring. A combination of ingress and egress filters are employed to mirror both request and response traffic flowing between the CE routers (R1 and R5) .

Remote port mirroring uses a tunnel for GRE encapsulation to send mirrored traffic to a remote analyzer device. Our topology has two analyzers. One is attached to the R2/PE1 router and the other to the R3/P router. This allows us to demonstrate two ways of mirroring CE traffic, one at a PE and the other on a core P router. We use a Centos host with Wireshark for packet capture and analysis.

PTX platforms use the Flexible Tunnel Interface (fti) infrastructure to support variety of tunneling applications. In the case of remote port mirrors, GRE tunnels are configured on fti interfaces to transport mirrored traffic to a remote analyzer device . As part of this example, you'll configure fti based GRE tunnels, a mirroring instance, and the firewall filters that select traffic to be mirrored.

For information about navigating the CLI, see Using the CLI Editor in Configuration Mode

This section highlights the configuration tasks needed to configure the PE1/R2 router in this example. We provide full configurations for all routers in the appendix. Step 1 summarizes the example's baseline. This baseline consists of IPv4 and IPv6 connectivity, MPLS, and a Layer 3 VPN. Our example places the focus on configuring and verifying remote port mirroring.

1. Configure the IP routing and L3 VPN baseline on the PE1 router. This involves the following:

   1. Numbering the interfaces for both IPv4 and IPv6 and including family mpls support on core facing interfaces.

   2. Configuring the OSPF and OSPFv3 routing protocols to provide reachability between all network interfaces.

   3. RSVP and MPLS label switched paths (LSPs) to support L3 VPN traffic.

   4. Configuring VRF and BGP peering with the inet-vpn and inet6-vpn address families for a PE router. Our VRF example uses OSPF and OSPF3 as the PE-CE routing protocol.

      content_copy zoom_out_map

      [edit]
      set interfaces et-0/0/0 unit 0 family inet address 10.0.12.2/24
      set interfaces et-0/0/0 unit 0 family inet6 address 2001:db8:10:0:12::2/64
      set interfaces et-0/0/1 unit 0 family inet address 10.0.23.1/24
      set interfaces et-0/0/1 unit 0 family inet6 address 2001:db8:10:0:23::1/64
      set interfaces et-0/0/1 unit 0 family mpls
      
      set interfaces lo0 unit 0 family inet address 192.168.0.2/32
      set interfaces lo0 unit 0 family inet6 address 2001:db8:192:168:0::2/128
      
      set policy-options policy-statement ospf-export term 1 from protocol bgp
      set policy-options policy-statement ospf-export term 1 then accept
      
      set routing-instances ce1 instance-type vrf
      set routing-instances ce1 protocols ospf area 0.0.0.0 interface all
      set routing-instances ce1 protocols ospf export ospf-export
      set routing-instances ce1 protocols ospf3 area 0.0.0.0 interface all
      set routing-instances ce1 protocols ospf3 export ospf-export
      set routing-instances ce1 interface et-0/0/0.0
      set routing-instances ce1 route-distinguisher 65001:1
      set routing-instances ce1 vrf-target target:65001:100
      set routing-instances ce1 vrf-table-label
      
      set routing-options router-id 192.168.0.2
      set routing-options autonomous-system 65001
      
      set protocols bgp group ibgp type internal
      set protocols bgp group ibgp local-address 192.168.0.2
      set protocols bgp group ibgp family inet unicast
      set protocols bgp group ibgp family inet-vpn unicast
      set protocols bgp group ibgp family inet6-vpn unicast
      set protocols bgp group ibgp neighbor 192.168.0.4
      
      set protocols mpls label-switched-path pe2 to 192.168.0.4
      set protocols mpls label-switched-path pe2 no-cspf
      set protocols mpls ipv6-tunneling
      set protocols mpls interface all
      set protocols mpls interface fxp0.0 disable
      
      set protocols ospf area 0.0.0.0 interface all
      set protocols ospf area 0.0.0.0 interface fxp0.0 disable
      
      set protocols ospf3 area 0.0.0.0 interface all
      set protocols ospf3 area 0.0.0.0 interface fxp0.0 disable
      
      set protocols rsvp interface all
      set protocols rsvp interface fxp0 disable
      

   With the baseline covered the remaining steps focus on configuring the R2/PE1 router to port mirror all traffic sent and received on its CE1 facing VRF interface.

2. You begin with configuration of the GRE tunnel. On a PTX router the tunnel is implemented over an fti interface. The source address for the GRE tunnel does not have to be routable, unless you expect to perform diagnostic ping testing sourced from or destined to the GRE tunnel source. The GRE destination for traffic mirrored by PE1 is the analyzer 1 router. This destination must be reachable for mirror traffic to be sent to the analyzer. We use a passive IGP instance to ensure IGP reachability to the analyzer networks.

   The destination address maps to the Analyzer 1 device attached to the et-0/0/2 interface on the P/R3 router. You must configure the fti logical interface with family ccc to support remote port mirroring on the PTX. This is because the mirror action occurs at Layer 2.

   content_copy zoom_out_map

   set interfaces fti0 unit 1 description "GRE tunnel for remote port mirror"
   set interfaces fti0 unit 1 tunnel encapsulation gre source address 10.100.0.1
   set interfaces fti0 unit 1 tunnel encapsulation gre destination address 10.0.100.1
   set interfaces fti0 unit 1 family ccc

   Note:

   A passive IGP instance is provisioned for the interfaces attached to the analyzer devices. This provides IGP reachability to the analyzer ports for the GRE encapsulated mirrored traffic. The passive setting prevents the generation of hello packets to the analyzers as this would just clutter up the captures.

   In addition, we configured a static route on the analyzer device to allow it to respond to pings as an aid in diagnostic testing. Strictly speaking, only simplex connectivity or routing is needed between the DUTs and the analyzer for remote port mirroring to function.

3. Configure the sampling instance. We use a rate of 1 to sample all matching packets. The default run-length of 1 is left in place given all matching traffic is already sampled. You must specify the logical interface on the fti router that is used to transport the mirror traffic. You configured unit 1 on the fti0 interface for the GRE tunnel in the previous step, so that same interface and unit is specified as the output interface in the mirror instance.
   content_copy zoom_out_map

   [edit]
   set forwarding-options port-mirroring instance pe-mirror input rate 1
   set forwarding-options port-mirroring instance pe-mirror family any output interface fti0.1

   Note:

   You can specify a maximum packet length for mirrored traffic at the [edit forwarding-options port-mirroring instance instance-name input] hierarchy with the maximum-packet-length option. By default the packet length is 0, which means the entire packet is mirrored.

4. Define two family any firewall filters to match on and mirror the CE traffic. Two filters are defined, one for mirroring CE1 to CE2 traffic, and the other for mirroring CE2 to CE1. The filters include a count function to assist in verification. The port mirror action directs matching traffic to the port mirroring instance you configured previously.

   Family any filters support both Layer 2 and Layer 3 matching. For the former, you can match on VLAN ID, interface, MAC address, or MPLS label. For the latter, you can match on standard IPv4 or IPv6 headers fields.

   Given our topology we use a match all term that catches all traffic sent or received by the CEs. This includes IPv4, IPv6, ARP, LLDP, and any routing protocols such as OSPF.

   content_copy zoom_out_map

   [edit]
   set firewall family any filter ce1-ce2 term mirror-ce1-ce2 then count ce1-ce2-mirror
   set firewall family any filter ce1-ce2 term mirror-ce1-ce2 then port-mirror-instance pe-mirror
   set firewall family any filter ce1-ce2 term mirror-ce1-ce2 then accept
   set firewall family any filter ce1-ce2 term else then accept
   
   set firewall family any filter ce2-ce1 term mirror-ce2-ce1 then count ce2-ce1-mirror
   set firewall family any filter ce2-ce1 term mirror-ce2-ce1 then port-mirror-instance pe-mirror
   set firewall family any filter ce2-ce1 term mirror-ce2-ce1 then accept
   set firewall family any filter ce2-ce1 term else then accept

   Both filters end with a match all accept term to override the default deny all action at the end of a Junos filter. In this way traffic that is not matched in the first term is accepted. This term is added as a safeguard in the event that later a specific match condition is added to the first term.

   If desired, you can evoke a policer action in your filter to limit the number of mirrored packets sent over the GRE tunnel. The policer is defined with a bandwidth and burst limit along with a discard action for traffic that exceeds the policer.

   You cannot apply a PM filter with a policer action in the egress direction.
   Note:

   If you wanted to match only ICMP traffic sent between the IPv4 loopback addresses of the CE devices add Layer 3 match criteria to your filter.

   content_copy zoom_out_map

   set firewall family any filter ce1-ce2 term mirror-ce1-ce2 from ip-version ipv4 ip-protocol icmp
   set firewall family any filter ce1-ce2 term mirror-ce1-ce2 from ip-version ipv4 ip-source-address 172.16.1.1/32
   set firewall family any filter ce1-ce2 term mirror-ce1-ce2 from ip-version ipv4 ip-destination-address 172.16.2.1/32
   set firewall family any filter ce1-ce2 term mirror-ce1-ce2 then count ce1-ce2-mirror
   set firewall family any filter ce1-ce2 term mirror-ce1-ce2 then port-mirror-instance pe-mirror
   set firewall family any filter ce1-ce2 term mirror-ce1-ce2 then accept
   set firewall family any filter ce1-ce2 term else then accept

5. Apply the filters to the CE facing interface on R2/PE1. For our example, that means application of the filters to the et-0/0/0 interface on PE1. Note the directionality of the filter application. An ingress and egress filter is needed to mirror both directions of CE traffic flow.

   content_copy zoom_out_map

   [edit]
   set interfaces et-0/0/0 unit 0 filter input ce1-ce2
   set interfaces et-0/0/0 unit 0 filter output ce2-ce1

For completeness we show the configuration of R2/PE1 in curly brace format.

system {
    host-name r2-ptx;
}
interfaces {
    et-0/0/0 {
        unit 0 {
            filter {
                input ce1-ce2;
                output ce2-ce1;
            }
            family inet {
                address 10.0.12.2/24;
            }
            family inet6 {
                address 2001:db8:10:0:12::2/64;
            }
        }
    }
    et-0/0/1 {
        unit 0 {
            family inet {
                address 10.0.23.1/24;
            }
            family inet6 {
                address 2001:db8:10:0:23::1/64;
            }
            family mpls;
        }
    }
    fti0 {
        unit 1 {
            description "GRE tunnel for remote port mirror";
            tunnel {
                encapsulation gre {
                    source {
                        address 10.100.0.1;
                    }
                    destination {
                        address 10.0.100.1;
                    }
                }
            }
            family ccc;
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 192.168.0.2/32;
            }
            family inet6 {
                address 2001:db8:192:168:0::2/128;
            }
        }
    }
}
forwarding-options {
    port-mirroring {
        instance {
            pe-mirror {
                input {
                    rate 1;
                }
                family any {
                    output {
                        interface fti0.1;
                    }
                }
            }
        }
    }
}
policy-options {
    policy-statement ospf-export {
        term 1 {
            from protocol bgp;
            then accept;
        }
    }
}
firewall {
    family any {
        filter ce1-ce2 {
            term mirror-ce1-ce2 {
                then {
                    count ce1-ce2-mirror;
                    port-mirror-instance pe-mirror;
                    accept;
                }
            }
        }
        filter ce2-ce1 {
            term mirror-ce2-ce1 {
                then {
                    count ce2-ce1-mirror;
                    port-mirror-instance pe-mirror;
                    accept;
                }
            }
        }
    }
}
routing-instances {
    ce1 {
        instance-type vrf;
        protocols {
            ospf {
                area 0.0.0.0 {
                    interface all;
                }
                export ospf-export;
            }
            ospf3 {
                area 0.0.0.0 {
                    interface all;
                }
                export ospf-export;
            }
        }
        interface et-0/0/0.0;
        route-distinguisher 65001:1;
        vrf-target target:65001:100;
        vrf-table-label;
    }
}
routing-options {
    router-id 192.168.0.2;
    autonomous-system 65001;
}
protocols {
    bgp {
        group ibgp {
            type internal;
            local-address 192.168.0.2;
            family inet {
                unicast;
            }
            family inet-vpn {
                unicast;
            }
            family inet6-vpn {
                unicast;
            }
            neighbor 192.168.0.4;
        }
    }
    mpls {
        label-switched-path pe2 {
            to 192.168.0.4;
            no-cspf;
        }
        ipv6-tunneling;
        interface all;
        interface fxp0.0 {
            disable;
        }
    }
    ospf {
        area 0.0.0.0 {
            interface all;
            interface fxp0.0 {
                disable;
            }
        }
    }

    ospf3 {
        area 0.0.0.0 {
            interface all;
            interface fxp0.0 {
                disable;
            }
            interface et-0/0/2.0 {
                passive;
            }
        }
    }
    rsvp {
        interface all;
    }
}

For information about navigating the CLI, see Using the CLI Editor in Configuration Mode

This section highlights the main configuration tasks needed to configure the P/R3 router in this example. We start with the MPLS-based L3 VPN baseline. Then, we show the steps needed to configure remote port mirroring on a P router to match on and mirror MPLS traffic.

1. Configure the IPv4 and IPv6 routing and MPLS baseline on the P/R3 router. This involves a few things:

   1. Numbering the interfaces for both IPv4 and IPv6 and including family mpls support on core facing interfaces.

   2. Configure the OSPF and OSPFv3 routing protocols to provide reachability between all network interfaces.

   3. RSVP and MPLS to support the L3 VPN data plane. As a P router, BGP peering and VRF definitions are not present.

      content_copy zoom_out_map

      [edit]
      set interfaces et-0/0/0 description "R3-R2 P-PE"
      set interfaces et-0/0/0 unit 0 family inet address 10.0.23.2/24
      set interfaces et-0/0/0 unit 0 family inet6 address 2001:db8:10:0:23::2/64
      set interfaces et-0/0/0 unit 0 family mpls
      set interfaces et-0/0/1 unit 0 family inet address 10.0.34.1/24
      set interfaces et-0/0/1 unit 0 family inet6 address 2001:db8:10:0:34::1/64
      set interfaces et-0/0/1 unit 0 family mpls
      set interfaces et-0/0/2 unit 0 family inet address 10.0.100.2/24
      set interfaces lo0 unit 0 family inet address 192.168.0.3/32
      set interfaces lo0 unit 0 family inet6 address 2001:db8:192:168:0::3/128
      
      set routing-options router-id 192.168.0.3
      
      set protocols mpls interface all
      set protocols mpls interface fxp0.0 disable
      set protocols mpls interface et-0/0/2.0 disable
      
      set protocols ospf area 0.0.0.0 interface all
      set protocols ospf area 0.0.0.0 interface fxp0.0 disable
      set protocols ospf area 0.0.0.0 interface et-0/0/2.0 passive
      
      set protocols ospf3 area 0.0.0.0 interface all
      set protocols ospf3 area 0.0.0.0 interface fxp0.0 disable
      set protocols ospf3 area 0.0.0.0 interface et-0/0/2.0 passive
      
      set protocols rsvp interface all
      set protocols rsvp interface fxp0 disable
      set protocols rsvp interface et-0/02.0 disable
      
      

      The P1/R3 router attaches to Analyzer 1 over the et-0/0/2 interface. We disable the RSVP protocol and MPLS support on this interface as the mirrored traffic arrives as IPv4 using GRE encapsulation. LSPs don't extend to the analyzer.

      Note:

      The et-0/0/2 interface configuration used here assumes that the analyzer replies to ARP and ND request sent by the DUT for MAC address resolution. If this is not the case, or if you wish that ARP traffic is not part of your packet captures, you should configure a static ARP entry. Be sure to specify the correct MAC address for the interface on the analyzer device that is attached to the DUT.

   With the baseline covered, the following steps focus on configuring remote port mirroring for MPLS traffic on a P router.

2. You begin with the definition of the GRE tunnel. On PTX platforms tunnels are implemented on an fti interface. The source address for the GRE tunnel does not have to be routable, unless you expect to perform diagnostic ping testing sourced from or destined to the GRE tunnel source. The GRE destination for mirrored traffic is the Analyzer 2 device attached to PE2/R4. This destination must be reachable for mirror traffic to be sent to the analyzer. We use a passive IGP instance to ensure IGP reachability to the analyzer networks.

   You must configure the fti logical interface with family ccc to support remote port mirroring on the PTX. This is because the mirror action occurs at Layer 2.

   content_copy zoom_out_map

   [edit]
   set interfaces fti0 unit 1 tunnel encapsulation gre source address 10.100.0.3
   set interfaces fti0 unit 1 tunnel encapsulation gre destination address 10.0.200.1
   set interfaces fti0 unit 1 family ccc

   Note:

   A passive IGP instance is provisioned for the interfaces attached to the analyzer devices. This provides IGP reachability to the analyzer ports for the GRE encapsulated mirrored traffic. The passive setting prevents the generation of hello packets to the analyzers as this would just clutter up the packet captures.

   In addition, we configured a static route on the analyzer device so it can respond to pings as an aid in diagnostic testing. Strictly speaking, only simplex connectivity or routing is needed between the DUTs and the analyzer for remote port mirroring to function.

3. Configure the sampling instance. We use a rate of 1 to select and sample all matching packets. By default the run-length is 1. This is fine given all matching traffic is sampled with a rate of 1. You must specify the logical interface on the fti router that is used to send the mirror traffic. You configured unit 1 for the fti interface in the previous step so that same unit is specified as the output interface for the mirror instance.
   content_copy zoom_out_map

   [edit]
   set forwarding-options port-mirroring instance p-router-mirror input rate 1
   set forwarding-options port-mirroring instance p-router-mirror family any output interface fti0.1

4. Define the firewall filters to mirror traffic sent between the CE routers.

   Family any filters only allow Layer 2 match types. For example, VLAN ID, interface, MAC address, or MPLS label. As a result you are not able to use IPv4 or IPv4 specific match conditions.

   Two filters are defined, one for each direction of traffic flow between the CEs.

   Given our goal of mirroring VPN traffic at a P router, the filters are written to match on the specific labels that identify MPLS traffic flows between the two PE routers.

   For the CE1 to CE2 direction, the filter matches on the RSVP transport label used by PE1 to reach PE2. Because of PHP and egress application, the filter used in the CE2 to CE1 direction matches on the VRF label advertised by PE1 to PE2. Matching traffic evokes the port mirror action to the mirroring instances defined previously. The filters include a count function to assist in confirmation of proper operation.

   We determined the correct labels using these commands:

   1. For traffic sent by CE1 to CE2, the current RSVP transport label is displayed with a show rsvp session ingress detail command. This is the RSVP assigned label used by PE1 to reach PE2 using MPLS. It should be noted that all VPN traffic sent between this PE pair uses the same RSVP transport. The resulting filter is not specific to the CE1 VRF on the PE router.

      content_copy zoom_out_map

      user@r2-ptx> show rsvp session ingress detail 
      
      Ingress RSVP: 1 sessions
      
      192.168.0.4
        From: 192.168.0.2, LSPstate: Up, ActiveRoute: 0
        LSPname: pe2, LSPpath: Primary
        LSPtype: Static Configured
        Suggested label received: -, Suggested label sent: -
        Recovery label received: -, Recovery label sent: 22
        Resv style: 1 FF, Label in: -, Label out: 22
        Time left:    -, Since: Tue Apr 18 12:58:47 2023
        Tspec: rate 0bps size 0bps peak Infbps m 20 M 1500
        Port number: sender 2 receiver 65196 protocol 0
        PATH rcvfrom: localclient 
        Adspec: sent MTU 1500
        Path MTU: received 1500
        PATH sentto: 10.0.23.2 (et-0/0/1.0) 1 pkts
        RESV rcvfrom: 10.0.23.2 (et-0/0/1.0) 1 pkts, Entropy label: Yes
        Record route: <self> 10.0.23.2 10.0.34.2  
      Total 1 displayed, Up 1, Down 0

      In this case the output shows that RSVP label 22 is assigned to the PE1/R2 router to reach the LSP egress at the PE2/R4 router.

   2. For traffic sent by CE2 to CE1 you must match on the VRF label. This is because the P router is the penultimate hop node and on the egress interface it will have popped the RSVP transport label. This leaves on the VRF label as the bottom of the stack. You confirm the VRF label advertised by PE1 to the PE2 with a show route advertising-protocol bgp remote-peer-address detail command. This command shows the routes advertised by the local PE along with the VRF label that is bound to the routing instance.

      content_copy zoom_out_map

      user@r2-ptx> show route advertising-protocol bgp 192.168.0.4 detail 
      
      ce1.inet.0: 7 destinations, 8 routes (7 active, 0 holddown, 0 hidden)
      * 10.0.12.0/24 (1 entry, 1 announced)
       BGP group ibgp type Internal
           Route Distinguisher: 65001:1
           VPN Label: 16
           Nexthop: Self
           Flags: Nexthop Change
           Localpref: 100
           AS path: [65001] I 
           Communities: target:65001:100
      
      * 172.16.1.1/32 (1 entry, 1 announced)
       BGP group ibgp type Internal
           Route Distinguisher: 65001:1
           VPN Label: 16
           Nexthop: Self
           Flags: Nexthop Change
           MED: 1
           Localpref: 100
           AS path: [65001] I 
           Communities: target:65001:100 rte-type:0.0.0.0:1:0
      . . .

      The output shows that PE1 signaled VRF label 16 to the PE2 router for the routes associated with the CE1 routing instance.

      Using the information from the previous commands we know which RSVP/VRF labels to match on in the firewall filter.

      content_copy zoom_out_map

      [edit]
      set firewall family any filter ce1-ce2 term ce1-ce2-mirror from mpls-label 22
      set firewall family any filter ce1-ce2 term ce1-ce2-mirror then count ce1-ce2-traffic
      set firewall family any filter ce1-ce2 term ce1-ce2-mirror then port-mirror-instance p-router-mirror
      set firewall family any filter ce1-ce2 term else then accept
      
      set firewall family any filter ce2-ce1 term ce2-ce1-mirror from mpls-label 16
      set firewall family any filter ce2-ce1 term ce2-ce1-mirror then count ce2-ce1-traffic
      set firewall family any filter ce2-ce1 term ce2-ce1-mirror then port-mirror-instance p-router-mirror
      set firewall family any filter ce2-ce1 term else then accept

      The filters end with a match all accept term to override the default deny all at the end of a Junos filter. In this way traffic that is not matched in the first term is accepted. This is critical to avoiding disrupting all other traffic using this interface!

      Note:

      RSVP labels can change due to LSP re-signaling caused by link outages or other configuration changes. We demonstrate how a filter can be used to match on specific labels to help constrain the traffic that is mirrored. You can always apply a match all filter to ensure that MPLS label changes does not affect mirroring. The disadvantage of the match all approach is you will mirror all traffic received on the P router interface to include the core protocols and non-VPN traffic.

5. Apply the filters to the PE1 facing interface on the P/R3 router. The directionality of the filter application is important. Our filters are designed to operate in the input direction for CE1 to CE2 traffic, and in the egress direction for CE2 to CE1 traffic. Because these are family any filters, they are applied at the unit level independent of either IPv4 or IPv6. Family any filters operate at Layer 2 which is independent of any protocol family.

   content_copy zoom_out_map

   [edit]
   set interfaces et-0/0/0 unit 0 filter input ce1-ce2
   set interfaces et-0/0/0 unit 0 filter output ce2-ce1

For completeness we show the configuration of R2/PE1 in curly brace format.

system {
    host-name r3-ptx;
}
interfaces {
    et-0/0/0 {
        description "R3-R2 P-PE";
        unit 0 {
            filter {
                input ce1-ce2;
                output ce2-ce1;
            }
            family inet {
                address 10.0.23.2/24;
            }
            family inet6 {
                address 2001:db8:10:0:23::2/64;
            }
            family mpls;
        }
    }
    et-0/0/1 {
        unit 0 {
            family inet {
                address 10.0.34.1/24;
            }
            family inet6 {
                address 2001:db8:10:0:34::1/64;
            }
            family mpls;
        }
    }
    et-0/0/2 {
        unit 0 {
            family inet {
                address 10.0.100.2/24;
            }
        }
    }
    fti0 {
        unit 1 {
            tunnel {
                encapsulation gre {
                    source {
                        address 10.100.0.3;
                    }
                    destination {
                        address 10.0.200.1;
                    }
                }
            }
            family ccc;
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 192.168.0.3/32;
            }
            family inet6 {
                address 2001:db8:192:168:0::3/128;
            }
        }
    }
}
forwarding-options {
    port-mirroring {
        instance {
            p-router-mirror {
                input {
                    rate 1;
                }
                family any {
                    output {
                        interface fti0.1;
                    }
                }
            }
        }
    }
}
firewall {
    family any {
        filter ce1-ce2 {
            term ce1-ce2-mirror {
                from {
                    mpls-label 22;
                }
                then {
                    count ce1-ce2-traffic;
                    port-mirror-instance p-router-mirror;
                }
            }
            term else {
                then accept;
            }
        }
        filter ce2-ce1 {
            term ce2-ce1-mirror {
                from {
                    mpls-label 16;
                }
                then {
                    count ce2-ce1-traffic;
                    port-mirror-instance p-router-mirror;
                }
            }
            term else {
                then accept;
            }
        }
    }
}
routing-options {
    router-id 192.168.0.3;
}
protocols {
    mpls {
        interface all;
        interface fxp0.0 {
            disable;
        }
        interface et-0/0/2.0 {
            disable;
        }
    }
    ospf {
        area 0.0.0.0 {
            interface all;
            interface fxp0.0 {
                disable;
            }
            interface et-0/0/2.0 {
                passive;
            }
        }
    }
    ospf3 {
        area 0.0.0.0 {
            interface all;
            interface fxp0.0 {
                disable;
            }
            interface et-0/0/2.0 {
                passive;
            }
        }
    }
    rsvp {
        interface all;
        interface et-0/0/2.0 {
            disable;
        }
    }
}

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

• R1 (CE1)
• R2 (PE1) DUT1
• R3 (P Router) DUT 2
• R4 (PE2)
• R5 (CE2)

del interfaces et-0/0/0
set interfaces et-0/0/0 unit 0 family inet address 10.0.12.1/24
set interfaces et-0/0/0 unit 0 family inet6 address 2001:db8:10:0:12::1/64
set interfaces lo0 unit 0 family inet address 172.16.1.1/32
set interfaces lo0 unit 0 family inet6 address 2001:db8:172:16:1::1/128
set routing-options router-id 172.16.1.1
set protocols ospf area 0.0.0.0 interface all
set protocols ospf area 0.0.0.0 interface fxp0.0 disable
set protocols ospf3 area 0.0.0.0 interface all
set protocols ospf3 area 0.0.0.0 interface fxp0.0 disable

set interfaces et-0/0/0 unit 0 filter input ce1-ce2
set interfaces et-0/0/0 unit 0 filter output ce2-ce1
set interfaces et-0/0/0 unit 0 family inet address 10.0.12.2/24
set interfaces et-0/0/0 unit 0 family inet6 address 2001:db8:10:0:12::2/64
set interfaces et-0/0/1 unit 0 family inet address 10.0.23.1/24
set interfaces et-0/0/1 unit 0 family inet6 address 2001:db8:10:0:23::1/64
set interfaces et-0/0/1 unit 0 family mpls
set interfaces fti0 unit 1 description "GRE tunnel for remote port mirror"
set interfaces fti0 unit 1 tunnel encapsulation gre source address 10.100.0.1
set interfaces fti0 unit 1 tunnel encapsulation gre destination address 10.0.100.1
set interfaces fti0 unit 1 family ccc
set interfaces lo0 unit 0 family inet address 192.168.0.2/32
set interfaces lo0 unit 0 family inet6 address 2001:db8:192:168:0::2/128
set forwarding-options port-mirroring instance pe-mirror input rate 1
set forwarding-options port-mirroring instance pe-mirror input run-length 1
set forwarding-options port-mirroring instance pe-mirror family any output interface fti0.1
set policy-options policy-statement ospf-export term 1 from protocol bgp
set policy-options policy-statement ospf-export term 1 then accept
set firewall family any filter ce1-ce2 term mirror-ce1-ce2 then count ce1-ce2-mirror
set firewall family any filter ce1-ce2 term mirror-ce1-ce2 then port-mirror-instance pe-mirror
set firewall family any filter ce1-ce2 term mirror-ce1-ce2 then accept
set firewall family any filter ce2-ce1 term mirror-ce2-ce1 then count ce2-ce1-mirror
set firewall family any filter ce2-ce1 term mirror-ce2-ce1 then port-mirror-instance pe-mirror
set firewall family any filter ce2-ce1 term mirror-ce2-ce1 then accept
set routing-instances ce1 instance-type vrf
set routing-instances ce1 protocols ospf area 0.0.0.0 interface all
set routing-instances ce1 protocols ospf export ospf-export
set routing-instances ce1 protocols ospf3 area 0.0.0.0 interface all
set routing-instances ce1 protocols ospf3 export ospf-export
set routing-instances ce1 interface et-0/0/0.0
set routing-instances ce1 route-distinguisher 65001:1
set routing-instances ce1 vrf-target target:65001:100
set routing-instances ce1 vrf-table-label
set routing-options router-id 192.168.0.2
set routing-options autonomous-system 65001
set protocols bgp group ibgp type internal
set protocols bgp group ibgp local-address 192.168.0.2
set protocols bgp group ibgp family inet unicast
set protocols bgp group ibgp family inet-vpn unicast
set protocols bgp group ibgp family inet6-vpn unicast
set protocols bgp group ibgp neighbor 192.168.0.4
set protocols mpls label-switched-path pe2 to 192.168.0.4
set protocols mpls label-switched-path pe2 no-cspf
set protocols mpls interface all
set protocols mpls interface fxp0.0 disable
set protocols ospf area 0.0.0.0 interface all
set protocols ospf area 0.0.0.0 interface fxp0.0 disable
set protocols ospf3 area 0.0.0.0 interface all
set protocols ospf3 area 0.0.0.0 interface fxp0.0 disable
set protocols ospf3 area 0.0.0.0 interface et-0/0/2.0 passive
set protocols rsvp interface all
set protocols rsvp interface fxp0 disable

set interfaces et-0/0/0 description "R3-R2 P-PE"
set interfaces et-0/0/0 unit 0 filter input ce1-ce2
set interfaces et-0/0/0 unit 0 filter output ce2-ce1
set interfaces et-0/0/0 unit 0 family inet address 10.0.23.2/24
set interfaces et-0/0/0 unit 0 family inet6 address 2001:db8:10:0:23::2/64
set interfaces et-0/0/0 unit 0 family mpls
set interfaces et-0/0/1 unit 0 family inet address 10.0.34.1/24
set interfaces et-0/0/1 unit 0 family inet6 address 2001:db8:10:0:34::1/64
set interfaces et-0/0/1 unit 0 family mpls
set interfaces et-0/0/2 unit 0 family inet address 10.0.100.2/24
set interfaces fti0 unit 1 tunnel encapsulation gre source address 10.100.0.3
set interfaces fti0 unit 1 tunnel encapsulation gre destination address 10.0.200.1
set interfaces fti0 unit 1 family ccc
set interfaces lo0 unit 0 family inet address 192.168.0.3/32
set interfaces lo0 unit 0 family inet6 address 2001:db8:192:168:0::3/128
set forwarding-options port-mirroring instance p-router-mirror input rate 1
set forwarding-options port-mirroring instance p-router-mirror input run-length 0
set forwarding-options port-mirroring instance p-router-mirror family any output interface fti0.1
set firewall family any filter ce1-ce2 term ce1-ce2-mirror from mpls-label 22
set firewall family any filter ce1-ce2 term ce1-ce2-mirror then count ce1-ce2-traffic
set firewall family any filter ce1-ce2 term ce1-ce2-mirror then port-mirror-instance p-router-mirror
set firewall family any filter ce1-ce2 term else then accept
set firewall family any filter ce2-ce1 term ce2-ce1-mirror from mpls-label 16
set firewall family any filter ce2-ce1 term ce2-ce1-mirror then count ce2-ce1-traffic
set firewall family any filter ce2-ce1 term ce2-ce1-mirror then port-mirror-instance p-router-mirror
set firewall family any filter ce2-ce1 term else then accept
set routing-options router-id 192.168.0.3
set protocols mpls interface all
set protocols mpls interface fxp0.0 disable
set protocols mpls interface et-0/0/2.0 disable
set protocols ospf area 0.0.0.0 interface all
set protocols ospf area 0.0.0.0 interface fxp0.0 disable
set protocols ospf area 0.0.0.0 interface et-0/0/2.0 passive
set protocols ospf3 area 0.0.0.0 interface all
set protocols ospf3 area 0.0.0.0 interface fxp0.0 disable
set protocols ospf3 area 0.0.0.0 interface et-0/0/2.0 passive
set protocols rsvp interface all
set protocols rsvp interface fxp0 disable

set interfaces et-0/0/0 unit 0 family inet address 10.0.34.2/24
set interfaces et-0/0/0 unit 0 family inet6 address 2001:db8:10:0:34::2/64
set interfaces et-0/0/0 unit 0 family mpls
set interfaces et-0/0/1 unit 0 family inet address 10.0.45.1/24
set interfaces et-0/0/1 unit 0 family inet6 address 2001:db8:10:0:45::1/64
set interfaces et-0/0/2 unit 0 family inet address 10.0.200.2/24
set interfaces lo0 unit 0 family inet address 192.168.0.4/32
set interfaces lo0 unit 0 family inet6 address 2001:db8:192:168:0::4/128
set policy-options policy-statement ospf-export term 1 from protocol bgp
set policy-options policy-statement ospf-export term 1 then accept
set routing-instances ce2 instance-type vrf
set routing-instances ce2 protocols ospf area 0.0.0.0 interface all
set routing-instances ce2 protocols ospf export ospf-export
set routing-instances ce2 protocols ospf3 area 0.0.0.0 interface all
set routing-instances ce2 protocols ospf3 export ospf-export
set routing-instances ce2 interface et-0/0/1.0
set routing-instances ce2 route-distinguisher 65001:2
set routing-instances ce2 vrf-target target:65001:100
set routing-options router-id 192.168.0.4
set routing-options autonomous-system 65001
set protocols bgp group ibgp type internal
set protocols bgp group ibgp local-address 192.168.0.4
set protocols bgp group ibgp family inet unicast
set protocols bgp group ibgp family inet-vpn unicast
set protocols bgp group ibgp family inet6-vpn unicast
set protocols bgp group ibgp neighbor 192.168.0.2
set protocols mpls label-switched-path pe1 to 192.168.0.2
set protocols mpls label-switched-path pe1 no-cspf
set protocols mpls ipv6-tunneling
set protocols mpls interface all
set protocols mpls interface fxp0.0 disable
set protocols ospf area 0.0.0.0 interface all
set protocols ospf area 0.0.0.0 interface fxp0.0 disable
set protocols ospf area 0.0.0.0 interface et-0/0/2.0 passive
set protocols ospf3 area 0.0.0.0 interface all
set protocols ospf3 area 0.0.0.0 interface fxp0.0 disable
set protocols ospf3 area 0.0.0.0 interface et-0/0/2.0 passive
set protocols rsvp interface all

set interfaces et-0/0/0 unit 0 family inet address 10.0.45.2/24
set interfaces et-0/0/0 unit 0 family inet6 address 2001:db8:10:0:45::2/64
set interfaces lo0 unit 0 family inet address 172.16.2.1/32
set interfaces lo0 unit 0 family inet6 address 2001:db8:172:16:2::1/128
set routing-options router-id 172.16.2.1
set protocols ospf area 0.0.0.0 interface all
set protocols ospf area 0.0.0.0 interface fxp0.0 disable
set protocols ospf3 area 0.0.0.0 interface all
set protocols ospf3 area 0.0.0.0 interface fxp0.0 disable

This section lists the caveats and limitations for remote port mirroring on PTX platforms.

1. If the output portion of the port mirroring instance configuration has to be changed, the existing output configuration should be deleted first and the change committed, before the new configuration is added.

2. A total of 15 mirror instances are supported. There is no commit error if the number of remote port mirror instances exceeds 15.

3. A given mirrored packet can be sent to only one remote analyzer.

4. The maximum packet length can be configured as multiple of 128 bytes. The exported packet will be 22 bytes less than the configured value.

5. Multiple output interfaces are not supported in a given mirroring instance. There is no commit error if multiple output interfaces are configured.

6. The sampling process is not GRES supported. There will be drops of mirrored traffic in the event of a GRES event or restart of the mirrord process.

7. Tunnel traffic that terminates on the local router cannot be mirrored in the egress direction.

8. You cannot use port mirroring with a filter that evokes a policer action in the egress direction.

9. Statistics related to mirrored packets must be verified through firewall counters or FTI interface statistics.