Description

This aricle provides a sample configuration for Port Mirroring on Integrated Routing and Bridging (IRB) interfaces.

Symptoms

Topology:

R1 -------------- irb.500- R2 -irb.501 ------------------ R3


Here irb.500 and irb.501 interfaces are part of bridge domain. The intent is to send the mirrored ports (irb.500 and irb.501) traffic to the mirroring port ge-8/0/2.

Solution



 Mirroried Ports config:
interfaces {
       ge-8/0/0 {
               unit 0 {
                      family bridge {
                              interface-mode access;
                              vlan-id 500;
                      }
               }
        }
        ge-8/0/1 {
                unit 0 {
                       family bridge {
                               interface-mode access;
                               vlan-id 501;
                       }
                }
         }
         irb {
               unit 500 {
                      family inet {
                              filter {
                                   input irb-capture;
                      }
                     address 10.10.10.100/24;
               }
         }
         unit 501 {
                family inet {
                        filter {
                             input irb-capture;
                 }
                address 20.20.20.100/24;
          }
    }
}

Mirroring Port config:
interfaces {
       ge-8/0/2 {
               unit 0 {
                      family inet {
                             address 192.168.10.1/24 {
                                      arp 192.168.10.2 mac 60:eb:69:0b:6c:56;
                             }
                      }
              }
       }
}

Forwarding-options configuration for port-mirroring:
forwarding-options {
        port-mirroring {
               input {
                       rate 1;
                       run-length 1;
               }
               family inet {
                       output {
                                interface ge-8/0/2.0;
                                       next-hop 192.168.10.2;
                       }
               }
        }
}

Firewall filter config:
firewall {
      family inet {
              filter irb-capture {
                   term all {
                         then {
                                port-mirror;
                                accept;
                         }
                   }
               }
        }
}

Bridge-domain config:
bridge-domains {
        vlan-500 {
               domain-type bridge;
               vlan-id 500;
               routing-interface irb.500;
        }
        vlan-501 {
               domain-type bridge;
               vlan-id 501;
               routing-interface irb.501;
        }
}

Use monitor command to verify:
> Monitor interface ge-8/0/2