Description

This article explains how to apply a firewall filter to mirror specific layer 2 traffic within a VLAN. There is a difference in configuration between legacy platforms and new platforms EX3400/EX4300.

Symptoms

The analyzer option is not available in the EX3400 series in firewall filter:

EX Legacy Platforms

set firewall family ethernet-switching filter mac-filter term t1 then analyzer test
set ethernet-switching-options analyzer test output interface ge-0/0/0.0

EX3400/4300

set firewall family ethernet-switching filter MAC_FILTER term 1 then port-mirror
set forwarding-options port-mirroring family ethernet-switching output interface ge-0/0/10.0

Additional limitation with EX3400

set firewall family ethernet-switching filter MAC_FILTER term 1 then port-mirror interface <interface name> ---limited to ingress only

Solution


Requirements :

  • Mirror traffic initiated from PC A to PC B.

  • Block ICMP between PC B to PC A.

  • All other traffic in that VLAN is allowed

  • PC A And PC B are in same VLAN 121

  • Wireshark PC is connected to port ge-0/0/10

Configuration:

set firewall family ethernet-switching filter MAC_FILTER term 1 from source-mac-address 04:e0:76:0c:2c:0a/48
set firewall family ethernet-switching filter MAC_FILTER term 1 from destination-mac-address 00:16:41:10:d0:0b/48
set firewall family ethernet-switching filter MAC_FILTER term 1 then port-mirror
set firewall family ethernet-switching filter MAC_FILTER term 1 then count ALLOW_MAC
set firewall family ethernet-switching filter MAC_FILTER term 2 from source-mac-address 00:16:41:10:d0:0b/48
set firewall family ethernet-switching filter MAC_FILTER term 2 from destination-mac-address 04:e0:76:0c:2c:0a/48
set firewall family ethernet-switching filter MAC_FILTER term 2 from ip-protocol icmp
set firewall family ethernet-switching filter MAC_FILTER term 2 then discard
set firewall family ethernet-switching filter MAC_FILTER term 2 then count Drop_ICMP
set firewall family ethernet-switching filter MAC_FILTER term 3 then accept
set firewall family ethernet-switching filter MAC_FILTER term 3 then count Allow-all
set vlans VLAN121 vlan-id 121
set vlans VLAN121 forwarding-options filter input MAC_FILTER


set forwarding-options port-mirroring family ethernet-switching output interface ge-0/0/10.0--Wireshark connected PC.

Related Information