Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
interfaces. For more information about next-hop groups, see “Configuring Next-Hop
Groups” on page 367.
All M Series Multiservice Edge Routers, T Series Core Routers, and MX Series Ethernet
Services Routers support port mirroring for IPv4 or IPv6. The M120, M320, and MX Series
routers support port mirroring for IPv4 and IPv6 simultaneously.
Port mirroring for VPLS traffic is supported on M7i and M10i routers configured with an
Enhanced CFEB (CFEB-E), on M120 routers, on M320 routers configured with an Enhanced
III Flexible PIC Concentrators (FPCs), and MX Series routers.
Port mirroring for VPLS traffic is supported on M7i and M10i routers configured with
Enhanced CFEBs (CFEB-Es), on M120 routers, on M320 routers configured with Enhanced
III Flexible PIC Concentrators (FPCs), and MX Series routers.
In Junos OS Release 9.3 and later, port mirroring is supported for Layer 2 traffic on MX
Series routers. For information about how to configure port mirroring for Layer 2 traffic,
see the Junos Layer 2 Configuration Guide.
In Junos OS Release 9.6 and later, port mirroring is supported for Layer 2 VPN traffic on
M120 routers and M320 routers configured with an Enhanced III FPC. You can also set
the maximum length of the mirrored packet. When set, the mirrored packet is truncated
to the specified length.
Configuration Guidelines
When configuring port mirroring, the following restrictions apply:
• Only transit data is supported.
• You can configure either IPv4 or IPv6 port mirroring but not both on M Series routers,
except for the M120 and M320 routers, which support port mirroring for IPv4 and IPv6
simultaneously.
• You can configure port mirroring for IPv4 and IPv6 simultaneously on the M120 and
M320 routers and the MX Series routers.
• Egress filtering of multicast is not supported on the M, T, and MX Series routers.
• You cannot configure firewall filters on the port-mirroring interface.
• You must include a firewall filter with both the accept action and the port-mirror action
modifier on the inbound interface. Port mirroring does not work if you specify the discard
action.
• The interface you configure for port mirroring should not participate in any kind of
routing activity.
• The destination address you specify should not have a route to the ultimate traffic
destination. For example, if the sampled IPv4 packets have a destination address of
192.68.9.10 and the port-mirrored traffic is sent to 192.68.20.15 for analysis, the device
associated with the latter address should not know a route to 192.68.9.10. Also, it
should not send the sampled packets back to the source address.
376
Copyright © 2010, Juniper Networks, Inc.