Description

This article discusses a configuration to exceed port-mirror instance limitation to a FPC.

Symptoms

When we configure more than two port-mirror instances under one FPC directly, the Junos will threw a commit error, and the commit will be failed.

Symptom shown as below:

# set chassis fpc 3 port-mirror-instance pm1
# set chassis fpc 3 port-mirror-instance pm2
# set chassis fpc 3 port-mirror-instance pm3
# set chassis fpc 3 port-mirror-instance pm4
# commit
[edit chassis fpc 3]
 'port-mirror-instance'
 number of elements exceeds limit of 2
error: configuration check-out failed: (number of elements exceeds limit)

Solution

To resolve about issue, the user can specify an instance that is not bound to the FPC in the firewall filter. The specified filter should inherit one of the two instances that have been bound to the FPC. If it does not, the packet is not marked for port-mirroring. If it does, then the packet will be sampled using the input parameters specified by the referred instance but the copy will be sent to the its own destination.

Example configuration:
# set chassis fpc 3 port-mirror-instance pm-1-master
# set chassis fpc 3 port-mirror-instance pm-2-master
# set forwarding-options port-mirroring instance pm-1-master input rate 1
# set forwarding-options port-mirroring instance pm-1-master family inet output interface <int> next-hop <IP>
# set forwarding-options port-mirroring instance pm-1-secondary input-parameters-instance pm-1-master
# set forwarding-options port-mirroring instance pm-1-secondary family inet output interface <int> next-hop <IP>
# set forwarding-options port-mirroring instance pm-2-master input rate 100
# set forwarding-options port-mirroring instance pm-2-master family inet6 output interface <int> next-hop <IP>
# set forwarding-options port-mirroring instance pm-2-secondary input-parameters-instance pm-2-master
# set forwarding-options port-mirroring instance pm-2-secondary family inet6 output interface <int> next-hop <IP>

Please Note: the secondary port-mirroring instance will inherit the input rate from the master instance.

You may read more information from doc:
https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/port-mirroring-instances.html#id-configuring-inline-port-mirroring

Modification History

2024-03-05 : Article Created
2024-03-06 : Adding "next-hop" to the port-mirror instance due to lab testing.