This KB explains the Port Mirroring feature on ACX series routers for models running JUNOS EVO.
It includes a sample configuration and CLI show commands to confirm the working state of port mirroring functionality.

Port mirroring is used to send a copy of network packets seen on one port to a network monitoring connection on another port.

The aim of this feature is to mirror the packet for a given Port, Bridge domain or flow in a specified direction (ingress/egress) to a destination which is connected to a sniffer or analyzer.

Mirroring as a functionality has two components:

1. Source of mirror => This is the input to mirror i.e., from there the traffic needs to be mirrored.
2. Destination of mirror => This is the output of mirror i.e., where the mirrored traffic needs to be sent

All the traffic ingress to a configured port can be mirrored. This is supported via Analyzer configuration.

Note: The config for the port-based mirroring is via IFL configuration where only unit 0 IFL is allowed as input. If not present We can configure a dummy unit "0", see below example:

set interfaces <> unit 0 description "dummy vlan for PM"
set interfaces <> unit 0 vlan-id 666

Sample syntax template for the mirroring configuration:

[edit forwarding-options analyzer] 
<name> { 
     ingress { 
          interface { 
             <name> or list of interfaces 
          } 
     } 
       egress { 
         interface { 
              <name> 
         } 
     } 
 
   output { 
      interface { 
         <name> 
      }  
   vlan { <vlan_name> VLAN name or VLAN id}
} 

Sample configuration on the router we are mirroring all the ingress traffic coming on et-0/0/5 and egress traffic on ae0, with this all the mirrored traffic will be sent on et-0/0/4.0 

Analyzer configuration 

user@host> show configuration forwarding-options analyzer
jtac {
    input {
        ingress {
            interface et-0/0/5.0;
        }
        egress {
            interface ae0.0;
        }
    }
    output {
        vlan {
            jtac;
        }
    }
}

user@host> 

Ingress interface configuration 

user@host> show configuration interfaces et-0/0/5
flexible-vlan-tagging;
encapsulation flexible-ethernet-services;
unit 0 {
    encapsulation vlan-bridge;
    vlan-id 10;
}
unit 400 {
    encapsulation vlan-vpls;
    vlan-id 400;
}

Egress interface configuration 

user@host> show configuration interfaces ae0
flexible-vlan-tagging;
encapsulation flexible-ethernet-services;
aggregated-ether-options {
    lacp {
        active;
    }
}
unit 0 {
    encapsulation vlan-bridge;
    vlan-id 10;
}
unit 100 {
    vlan-id 100;
    family inet {
        address 10.100.1.2/24;
    }
    family mpls;
}

user@host> show configuration vlans
jtac {
    vlan-id 20;
    interface et-0/0/4.0;
}
jtac2 {
    vlan-id 10;
    interface ae0.0;
    interface et-0/0/5.0;
}

user@host>

After configuration commit, check the analyzer status with the show command:

user@host> show forwarding-options analyzer
  Analyzer name                    : jtac
  Mirror rate                      : 1
  Maximum packet length            : 0
  State                            : up
  Ingress monitored interfaces     : et-0/0/5.0
  Egress monitored interfaces      : ae0.0
  Output VLAN                      : default-switch/jtac

user@host> show forwarding-options analyzer jtac
  Analyzer name                    : jtac
  Mirror rate                      : 1
  Maximum packet length            : 0
  State                            : up
  Ingress monitored interfaces     : et-0/0/5.0
  Egress monitored interfaces      : ae0.0
  Output VLAN                      : default-switch/jtac

user@host>
user@host>