This KB describes about configuration used for port mirroring the L2 traffic when using plain L2 tagged interface. This is applicable also for monitoring the end customer's inner VLAN traffic coming in and can be used for troubleshooting / understanding what traffic is coming in from an L2 interface.

we shall take the below configuration as reference config:

Interface related config:

 ae22 {

    description TEST-IN;

    flexible-vlan-tagging;

    mtu 1530;

    encapsulation flexible-ethernet-services;

    aggregated-ether-options {

      lacp {

        active;

      }

    }

    unit 111 {

      description TEST;

      encapsulation vlan-bridge;

      vlan-id 111;

    }

}

VLAN configuration as its a pure L2 extended switch scenario.

  VLAN111-TEST {

    vlan-id 111;

    interface ae5.111;

    interface ae22.111;

    switch-options {

      interface ae5.111 {

        no-mac-learning;

      }

      interface ae22.111 {

        no-mac-learning;

      }

    }

  }

customer would like to capture the layer 2 traffic on a remote interface for troubleshooting another issue and since its an L2 interface his approach was to use port mirroring to his server facing interface.

Follow the below steps to capture the L2 tagged packets using port mirroring on PTX10001-36mr/PTX10003/PTX10008 router running EVO image.

1. Configure a firewall any filter for L2 traffic where there is no CCC or ethernet-switching encapsulation configured.
2. Apply this filter on incoming interface
3. Configure the output interface with below encapsulation as its only plain L2 tagged interface:
4. Configure the port mirroring configuration to mirror the L2 traffic.
5. Verify if the port mirroring interface is up or not

Step 1:

set firewall family any filter TEST term 1 then count TEST

set firewall family any filter TEST term 1 then port-mirror

set firewall family any filter TEST term 1 then accept

Step 2:

set interface ae22 unit 111 filter input TEST

Step 3:

set interfaces et-0/1/0:0 encapsulation ethernet-ccc

set interfaces et-0/1/0:0 unit 0 family ccc

step 4:

set forwarding-options port-mirroring input rate 1

set forwarding-options port-mirroring family any output interface et-0/1/0:0.0

Step 5:

show forwarding-options port-mirroring

Instance Name: &global_instance               
  Instance Id: 1              
  Input parameters:
    Rate                  : 1
    Run-length            : 0
    Maximum-packet-length : 0
  Output parameters:
    Family              State     Destination          Next-hop
    any                 up        et-0/1/0:0.0         NA       

Please check online document below for more details.

https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/example/port-mirror-family-any.html

Please pay attention to the limitation mentioned in above document:

Limitations

• Enterprise–provider-style L2 configuration (ethernet-switching) is not supported by the family any filter.

• One sampled packet can be sent to only one remote port mirror instance. The same sampled packet cannot be sent to multiple NMS devices.

• Statistics related to port-mirrored packets must be verified through the firewall filter or the FTI.

• MPLS traffic on egress is not supported by the family any filter.

• An aggregated Ethernet (ae) interface is not supported as the outgoing interface on the family any filter.