Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Announcement: Try the Ask AI chatbot for answers to your technical questions about Juniper products and solutions.

close
header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

Defining a Next-Hop Group on MX Series Routers for Port Mirroring

date_range 24-Nov-23

Starting with release 14.2, on routers containing an Internet Processor II application-specific integrated circuit (ASIC) or T Series Internet Processor, you can send a copy of an IP version 4 (IPv4) or IP version 6 (IPv6) packet from the router to an external host address or a packet analyzer for analysis. This is known as port mirroring.

Port mirroring is different from traffic sampling. In traffic sampling, a sampling key based on the IPv4 header is sent to the Routing Engine. There, the key can be placed in a file, or cflowd packets based on the key can be sent to a cflowd server. In port mirroring, the entire packet is copied and sent out through a next-hop interface.

You can configure simultaneous use of sampling and port mirroring, and set an independent sampling rate and run-length for port-mirrored packets. However, if a packet is selected for both sampling and port mirroring, only one action can be performed, and port mirroring takes precedence. For example, if you configure an interface to sample every packet input to the interface and a filter also selects the packet to be port mirrored to another interface, only the port mirroring takes effect. All other packets not matching the explicit filter port-mirroring criteria continue to be sampled when forwarded to their final destination.

Next-hop groups allow you to include port mirroring on multiple interfaces.

On MX Series routers, you can mirror tunnel interface input traffic to multiple destinations. To this form of multipacket port mirroring, you specify two or more destinations in a next-hop group, define a firewall filter that references the next-hop group as the filter action, and then apply the filter to a logical tunnel interface lt-) or virtual tunnel interfaces (vt- on the MX Series router.

To define a next-hop group for a Layer 2 port-mirroring firewall filter action:

  1. Enable the configuration of forwarding options.
    content_copy zoom_out_map
    [edit]
    user@host set forwarding-options port-mirroring family (inet | inet6) output
    
  2. Enable configuration of a next-hop-group for Layer 2 port mirroring.
    content_copy zoom_out_map
    [edit forwarding-options port-mirroring ... family (inet | inet6) output]
    user@host# set next-hop-group next-hop-group-name
    
  3. Specify the type of addresses to be used in the next-hop group configuration.
    content_copy zoom_out_map
    [edit forwarding-options port-mirroring ... family (inet | inet6) output next-hop-group next-hop-group-name]
    user@host# set group-type inet6
    
  4. Specify the interfaces of the next-hop route.
    content_copy zoom_out_map
    [edit forwarding-options port-mirroring ... family (inet | inet6) output next-hop-group next-hop-group-name]
    user@host# set interface logical-interface-name-1
    user@host# set interface logical-interface-name-2
    

    or

    content_copy zoom_out_map
    [edit forwarding-options port-mirroring ... family (inet | inet6) output next-hop-group next-hop-group-name]
    user@host# set interface interface-name next-hop next-hop-address
    

    The MX Series router supports up to 30 next-hop groups. Each next-hop group supports up to 16 next-hop addresses. Each next-hop group must specify at least two addresses. The next-hop-address can be an IPv4 or IPv6 address.

  5. (Optional) Specify the next-hop subgroup.
    content_copy zoom_out_map
    [edit forwarding-options port-mirroring ... family (inet | inet6) output next-hop-group next-hop-group-name]
    user@host# set next-hop-subgroup subgroup-name interface interface-name next-hop next-hop-address
    
  6. Verify the configuration of the next-hop group.
    content_copy zoom_out_map
    [edit forwarding-options port-mirroring ... family (inet | inet6) output next-hop-group next-hop-group-name]
    user@host# top
    [edit]
    user@host# show forwarding-options
     
    ...
    next-hop-group next-hop-group-name { 
        group-type inet6;
        interface logical-interface-name-1;
        interface interface-name{
            next-hop next-hop-address;
        }
        next-hop-subgroup subgroup-name{
            interface interface-name{
                next-hop next-hop-address;
            }
        }
    }
    ...
    

Change History Table

Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.

Release
Description
14.2
Starting with release 14.2, on routers containing an Internet Processor II application-specific integrated circuit (ASIC) or T Series Internet Processor, you can send a copy of an IP version 4 (IPv4) or IP version 6 (IPv6) packet from the router to an external host address or a packet analyzer for analysis.
footer-navigation