Description

Guidelines for using port mirroring with firewall filters on the EX-Series Switch.

Symptoms


Solution

Using firewall filters with port mirroring can have non-intuitive results. This KB describes some guidelines to follow.

NOTE: See Link URL below for additional information concerning port mirroring and applying filters.

Guidelines:

  1. Do not specify any input stanza for the analyzer, only output. The analyzer input is specified at the firewall filter then action line. If we specify an input on the analyzer, it will override the filter config and the filter will be ineffective.

  • When monitoring a layer 2 source port we can only apply a filter in the inbound direction, so any filtering happens only for ingress traffic. Egress traffic on the source port will not be filtered, and will reach the analyzer output port.

  • The analyzer action is enough in the filter then clause. "No accept" is needed since analyzer action will implicitly accept and send a copy to the analyzer output port.

  • When we apply the input firewall filter to a source port or VLAN, the filter works like any normal filter.  Filtering action takes place as usual - this implies that any traffic that doesn't match any filter term, will be implicitly denied at the end of the filter. So this can block traffic if we do not catch all remaining traffic at the end and specify an accept action for it.

    term catch-all {
        then accept;
    }

  • Mirroring high volume of traffic can be performance intensive for the switch. Therefore, you should disable it when you are not using it, and select specific input interfaces in preference to using the "all" keyword. You can also limit the amount of mirrored traffic with statistical sampling using the ratio keyword.

    [edit]
    juniper@3200-24-1# set ethernet-switching-options analyzer spy ratio ?
    Possible completions:
      <ratio>               Packet Ratio (0..2047)

  • You can send copies of a sampling of packets to the analyzer port or VLAN by setting the ratio to 1:1 (every packet) through 1:2047 (one out of every 2047 packets). Default is 1:1.

  • We can also specify the loss priority as low or high on the packets being monitored.

    [edit]
    juniper@3200-24-1# set ethernet-switching-options analyzer spy loss-priority ?                 
    Possible completions:
      high                 Loss priority high
      low                  Loss priority low

  • If the analyzer output interface reaches capacity, packets are dropped. You should consider whether the traffic being mirrored exceeds the capacity of the analyzer output interface.

  • Packets with physical-layer errors are filtered out and thus are not sent to the analyzer port or VLAN.

Related Information