Description

This article provides information on how to configure Layer 2 VPLS/Bridge port mirroring in MX routers.

Symptoms

How to configure Layer 2 VPLS/Bridge port mirroring in MX routers.

Solution


Topology :
CE1(ge-2/2/0)--vpls--(ge-2/2/1)PE1(xe-4/0/0)--Core--(ge-0/1/0)PE2(ge-0/0/0)--vpls--(ge-2/2/0)CE2
With reference to the above topology, in PE1, both the ingress and egress traffic on the ge-2/2/1 interface is mirrored and forwarded to the analyzer; which is connected to PE1 via the xe-4/2/0 interface.
  1. Configure the Port mirror forwarding options (In this example, the port mirror instance is used):
    [edit forwarding-options port-mirroring ]
    instance {
         pm_instance1 {
             input {
                 rate 1;
             }
    family inet {
        output {
            interface xe-4/2/0.0 {
                next-hop 203.203.203.2;
            }
        }
    }
    family vpls {
         output {
             interface xe-4/2/0.20;
             no-filter-check;
         }
    }
        }
    }

  • Port Mirror output Port configuration:
    [edit interfaces xe-4/2/0]


    flexible-vlan-tagging;
    encapsulation flexible-ethernet-services;
    unit 0 {
         vlan-id 10;
         family inet {
             address 203.203.203.1/30;
         }
    }
    unit 20 {
        encapsulation vlan-bridge;
        vlan-id 20;
    }

  • Associate the Port Mirror output to a dedicated bridge domain:
    [edit bridge-domains]

    instance1 {
         vlan-id none;
         interface xe-4/2/0.20;
    }

  • Filters for the mirror input interfaces:
    [edit firewall]

    family vpls {
         filter test_vpls {
             term 0 {
                 then {
                     count vpls;
                     accept;
                     port-mirror-instance pm_instance1;
                 }
             }
         }
    }

  • Apply the filter for the mirror input interfaces:
    [edit interfaces ge-2/2/1]

    vlan-tagging;
    encapsulation vlan-vpls;
    unit 0 {
         encapsulation vlan-vpls;
         vlan-id 600;
         family vpls {
             filter {
                 input test_vpls;
                 output test_vpls;
             }
         }
    }

  • Configuration for forwarding the port mirror traffic in the ingress chassis:
    [edit chassis]

    fpc 2 {
        port-mirror-instance pm_instance1;
    }

  • Output of the port mirror port:
    jtac-ggsn-pgw-blr Seconds: 8 Time: 09:08:47
    Delay: 0/0/4
    Interface: xe-4/2/0.20, Enabled, Link is Up
    Flags: SNMP-Traps 0x20004000
    Encapsulation: VLAN-Bridge
    VLAN-Tag [ 0x8100.20 ]
    Local statistics: Current delta
    Input bytes: 0 [0]
    Output bytes: 0 [0]
    Input packets: 0 [0]
    Output packets: 0 [0]
    Remote statistics:
    Input bytes: 0 (0 bps) [0]
    Output bytes: 96605722 (13388600 bps) [12839750]
    Input packets: 0 (0 pps) [0]
    Output packets: 66811 (1154 pps) [8855]
    Traffic statistics: Input bytes: [0]

    lab@jtac-ggsn-pgw-blr> show firewall filter test_vpls

    Filter: test_vpls
    Counters:
    Name Bytes Packets
    vpls 88485690 61452

    lab@jtac-ggsn-pgw-blr> show firewall filter test_vpls

    Filter: test_vpls
    Counters:
    Name Bytes Packets
    vpls 90915890 63128