This article explains how to configure port mirroring on MX devices with the help of an example.

For basic port configuration steps, refer also to Configuring Port Mirroring on M, T MX, and PTX Series Routers.

 

 

Topology

 

• In the above setup, SSH traffic is being sent from ixia port 10/11 to ixia port 10/12.

• The spirent port 1/6 is the collector. 

• Interface xe-0/0/1 is mirrored to ge-3/2/6 on the MX960 router.

 

 

Example Configuration

labroot@MX480# show interfaces ge-5/0/6  
unit 0 {
    family inet {
        address 10.10.1.1/30;
    }
}


labroot@MX480# show interfaces xe-0/0/2    
unit 0 {
    family inet {
        address 10.10.3.1/30;
    }
}


labroot@jtac-MX960-r005# show interfaces xe-0/0/1 
unit 0 {
    family inet {
        filter {
            input ingress;
        }
        address 10.10.3.2/30;
    }
}


labroot@jtac-MX960-r005# show interfaces ge-3/2/4 
unit 0 {
    family inet {
        address 10.10.8.1/30;
    }
}


labroot@jtac-MX960-r005# show interfaces ge-3/2/6 
unit 0 {
    family inet {
        address 10.10.6.2/30;
    }
}


labroot@jtac-MX960-r005# show forwarding-options 
port-mirroring {
    instance {
        ingress {
            input {
                rate 1;
            }
            family inet {
                output {
                    interface ge-3/2/6.0 {
                        next-hop 10.10.6.1;
                    }
                    no-filter-check;
                }
            }
        }
    }
}


labroot@jtac-MX960-r005# show firewall     
family inet {
    filter ingress {
        term 1 {
            from {
                source-address {
                    10.10.1.2/32;
                }
                destination-address {
                    10.10.9.2/32;
                }
                destination-port ssh;
            }
            then {
                port-mirror-instance ingress;
                accept;
            }
        }
        term 2 {
            then accept;
        }
    }
}

Verification

labroot@jtac-MX960-r005# run show forwarding-options port-mirroring   
Instance Name: ingress                       
  Instance Id: 4             
  Input parameters:
    Rate                  : 1
    Run-length            : 0
    Maximum-packet-length : 0
  Output parameters:
    Family              State     Destination          Next-hop
    inet                up        ge-3/2/6.0           10.10.6.1           

Capturing packets on the spirent port will show the packets that are being input to xe-0/0/1.

 

• 2020-08-19: Modified article and topology to make it compliant to standards; article checked for accuracy

• 2020-07-10: Modified and removed outbound filter configuration in Solution section