Пример настройки зеркалирования трафика на Juniper EX3200 (12.3R6.6) в VLAN.
Интерфейс который необходимо мониторить:
set interfaces ge-0/0/0 apply-groups grp-vlan-2-5-8-9-trunk
set interfaces ge-0/0/0 description SRX
set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members vlan_20
set interfaces ge-0/0/0 unit 0 family ethernet-switching filter input PROTECT-DMZ-NETWORK
set interfaces ge-0/0/0 unit 0 family ethernet-switching filter output BLOCK-IP-TO-INET
Создадим отдельный VLAN для мониторинга:
set vlans MIRROR-EX-VLAN vlan-id 999
set vlans MIRROR-EX-VLAN interface ge-0/0/23.0
Интерфейс в который подключена система мониторинга:
set interfaces ge-0/0/23 description port_mirroring
set interfaces ge-0/0/23 unit 0 family ethernet-switching port-mode access
set interfaces ge-0/0/23 unit 0 family ethernet-switching vlan members MIRROR-EX-VLAN
Настройка самого зеркалирования:
set ethernet-switching-options analyzer MIRROR-VLAN ratio 1
set ethernet-switching-options analyzer MIRROR-VLAN loss-priority high
set ethernet-switching-options analyzer MIRROR-VLAN input ingress interface ge-0/0/0.0
set ethernet-switching-options analyzer MIRROR-VLAN input egress interface ge-0/0/0.0
set ethernet-switching-options analyzer MIRROR-VLAN output vlan MIRROR-EX-VLAN
Проверка:
123@EX3200> show analyzer
Analyzer name : MIRROR-VLAN
Output VLAN : MIRROR-EX-VLAN
Mirror ratio : 1
Loss priority : High
Ingress monitored interfaces : ge-0/0/0.0
Egress monitored interfaces : ge-0/0/0.0
123@EX3200> monitor interface ge-0/0/23
Interface: ge-0/0/23, Enabled, Link is Up
Encapsulation: Ethernet, Speed: 1000mbps
Traffic statistics: Current delta
Input bytes: 11350666 (0 bps) [0]
Output bytes: 543264981612 (1224736 bps) [153129]
Input packets: 21684 (0 pps) [0]
Output packets: 898857459 (745 pps) [746]
Интерфейс который необходимо мониторить:
set interfaces ge-0/0/0 apply-groups grp-vlan-2-5-8-9-trunk
set interfaces ge-0/0/0 description SRX
set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members vlan_20
set interfaces ge-0/0/0 unit 0 family ethernet-switching filter input PROTECT-DMZ-NETWORK
set interfaces ge-0/0/0 unit 0 family ethernet-switching filter output BLOCK-IP-TO-INET
Создадим отдельный VLAN для мониторинга:
set vlans MIRROR-EX-VLAN vlan-id 999
set vlans MIRROR-EX-VLAN interface ge-0/0/23.0
Интерфейс в который подключена система мониторинга:
set interfaces ge-0/0/23 description port_mirroring
set interfaces ge-0/0/23 unit 0 family ethernet-switching port-mode access
set interfaces ge-0/0/23 unit 0 family ethernet-switching vlan members MIRROR-EX-VLAN
Настройка самого зеркалирования:
set ethernet-switching-options analyzer MIRROR-VLAN ratio 1
set ethernet-switching-options analyzer MIRROR-VLAN loss-priority high
set ethernet-switching-options analyzer MIRROR-VLAN input ingress interface ge-0/0/0.0
set ethernet-switching-options analyzer MIRROR-VLAN input egress interface ge-0/0/0.0
set ethernet-switching-options analyzer MIRROR-VLAN output vlan MIRROR-EX-VLAN
Проверка:
123@EX3200> show analyzer
Analyzer name : MIRROR-VLAN
Output VLAN : MIRROR-EX-VLAN
Mirror ratio : 1
Loss priority : High
Ingress monitored interfaces : ge-0/0/0.0
Egress monitored interfaces : ge-0/0/0.0
123@EX3200> monitor interface ge-0/0/23
Interface: ge-0/0/23, Enabled, Link is Up
Encapsulation: Ethernet, Speed: 1000mbps
Traffic statistics: Current delta
Input bytes: 11350666 (0 bps) [0]
Output bytes: 543264981612 (1224736 bps) [153129]
Input packets: 21684 (0 pps) [0]
Output packets: 898857459 (745 pps) [746]
Комментариев нет:
Отправить комментарий