Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

EX Switch Remote Port Mirror for analyzing network traffic

0

0

Article ID: KB16324 KB Last Updated: 25 Apr 2012Version: 2.0
Summary:
This article provides a method for configuring port-mirroring across multiple EX Switches (equivilent term - RSPAN - Remote Switched Port Analyzer)
Symptoms:

Solution:
Remote Analyzer works by configuring a Local Analyzer on each and every EX connected by  a trunk (cannot use access ports).

This test scenario describes how the traffic on ge-0/0/20 of EX1 is mirrored on ge-0/0/0 of EX3

PC-A (ge-0/0/20)----------------[EX1]------Trunk (VLAN444)-------[EX2]------Trunk (VLAN888)---------[EX3]------------ (ge-0/0/0)Analyzer


Configuration:

==> Configure "Input Ingress & Egress interface ge-0/0/20" & "Output vlan 444" in EX1
#set ethernet-switching-options analyzer bal input ingress interface ge-0/0/20
#set ethernet-switching-options analyzer bal input egress interface ge-0/0/20
#set ethernet-switching-options analyzer bal output vlan 444
#set vlan v444 vlan-id 444
#set interface ge-0/0/10.0 family ethernet-switching port-mode trunk vlan members 444
==> Configure "Input Ingress VLAN 444" & "Output VLAN 888" in EX2 
#set ethernet-switching-options analyzer bal input ingress vlan 444
#set ethernet-switching-options analyzer bal output vlan 888
#set vlan v444 vlan-id 444
#set interface ge-0/0/10.0 family ethernet-switching port-mode trunk vlan members 444
#set vlan v888 vlan-id 888
#set interface ge-0/0/20.0 family ethernet-switching port-mode trunk vlan members 888
==> Configure "Input Ingress VLAN 888" & "Output interface ge-0/0/0" in EX3
#set ethernet-switching-options analyzer bal input ingress vlan 888
#set ethernet-switching-options analyzer bal output interface ge-0/0/0
#set vlan v888 vlan-id 888
#set interface ge-0/0/20.0 family ethernet-switching port-mode trunk vlan members 888


Note: Analyzer VLAN(s) (VLAN444 and VLAN888) should not have more than one trunk interface being a member of it on each (respective) EX

Limitations of RSPAN:
==> Only one active Analyzer permissible per EX
==> Only one Trunk port permissible on any VLAN that is used in Analyzer
==> Mirrored packets exiting a tagged interface might contain incorrect VLAN ID
==> Tagged packets mirrored to an analyzer port might contain incorrect ether type
==> Packets with physical layer errors are filtered out and thus are not sent to the analyzer port or analyzer VLAN
==> Aggregated interfaces cannot be used either directly or using VLAN
==> Cannot mirror packets exiting or entering the following ports:

Related Links

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search