This article explains port mirroring and defining port mirroring firewall filter

This is a troubleshooting approach knowledge base. this article explains the configuration of port mirroring and defining firewall filters for port mirroring.

What is Port mirroring?

Port mirroring is the ability of a router to send a copy of an IPv4 or IPv6 packet to an external host address or a packet analyzer for analysis. Port mirroring is different from traffic sampling. In traffic sampling, a sampling key based on the packet header is sent to the Routing Engine. There, the key can be placed in a file, or cflowd packets based on the key can be sent to a cflowd server. In port mirroring, the entire packet is copied and sent out through a next-hop interface.

One application for port mirroring sends a duplicate packet to a virtual tunnel. A next-hop group can then be configured to forward copies of this duplicate packet to several interfaces.

When configuring port mirroring, the following restrictions apply:

• Only transit data is supported.

• You can configure either IPv4 or IPv6 port mirroring but not both on M Series routers, except for the M120 and M320 routers, which support port mirroring for IPv4 and IPv6 simultaneously.

• You can configure port mirroring for IPv4 and IPv6 simultaneously on the M120 and M320 routers and the MX Series routers.

• Port mirroring in the ingress and egress direction is not supported for link services IQ (lsq-) interfaces

Configuring Port Mirroring:

To configure port mirroring, include the port-mirroring statement at the [edit forwarding-options] hierarchy level.

[edit forwarding-options]

port-mirroring {

   family (ccc | inet | inet6 | vpls) {

       output {

           interface interface-name {

               next-hop address;

           }

           no-filter-check;

       }

       input {

           maximum-packet-length bytes;

           rate number;

           run-length number;

       }

   }

}

Defining Port Mirroring Firewall Filter:

Port mirroring is different from traffic sampling. In traffic sampling, a sampling key based on the IPv4 header is sent to the Routing Engine. There, the key can be placed in a file, or cflowd packets based on the key can be sent to a cflowd server. In port mirroring, the entire packet is copied and sent out through a next-hop interface.

You can configure the simultaneous use of sampling and port mirroring and set an independent sampling rate and run length for port-mirrored packets. However, if a packet is selected for both sampling and port mirroring, only one action can be performed and port mirroring takes precedence. For example, if you configure an interface to sample every packet input to the interface and a filter also selects the packet to be port mirrored to another interface, only the port mirroring would take effect. All other packets not matching the explicit filter port-mirroring criteria continue to be sampled when forwarded to their final destination.

Firewall filters provide a means of protecting your router from excessive traffic transiting the router to a network destination or destined for the Routing Engine. Firewall filters that control local packets can also protect your router from external incident

You can configure a firewall filter to do the following:

• Restrict traffic destined for the Routing Engine based on its source, protocol, and application.
• Limit the traffic rate of packets destined for the Routing Engine to protect against flood, or denial-of-service (DoS) attacks.
• Address special circumstances associated with fragmented packets destined for the Routing Engine. Because the device evaluates every packet against a firewall filter (including fragments), you must configure the filter to accommodate fragments that do not contain packet header information. Otherwise, the filter discards all but the first fragment of a fragmented packet.

To define a firewall filter with a port-mirroring action:

• Prepare traffic for port mirroring by including the filter statement at the [edit firewall family (inet | inet6)] hierarchy level.

filter filter-name;

• This filter at the [edit firewall family (inet | inet6)] hierarchy level selects traffic to be port-mirrored:

filter filter-name {

   term term-name {

       then {

           port-mirror;

           accept;

       }

   }

}

• Enable configuration of firewall filters.

[edit]

user@host# edit firewall family family

The value of the family option can be inet or inet6.

• Enable configuration of a firewall filter filter-name.

[edit firewall family family]

user@host# edit filter filter-name

• Enable configuration of a firewall filter term filter-term-name

[edit firewall family family filter filter-name]

user@host# edit term filter-term-name

• Specify the firewall filter match conditions based on the route source address to mirror a subset of the sampled packets
• Enable configuration of the action and action-modifier to apply to the matching packets.

[edit firewall family family filter filter-name term filter-term-name]

user@host# edit then

• Specify the actions to be taken on matching packets.

[edit firewall family family filter filter-name term filter-term-name then]

user@host# set action

The recommended value for the action is accept. If you do not specify an action, or if you omit the then statement entirely, all packets that match the conditions in the from statement are accepted.

• Specify port-mirror as the action modifier.

When the filter action is port-mirror, the packet is copied to a local interface for local or remote monitoring.

[edit firewall family family filter filter-name term filter-term-name then]
user@host# set port-mirror

• Verify the minimum configuration of the firewall filter.

[edit firewall ... ]
user@host# top
[edit]
user@host# show firewall
 
family (inet | inet6) { # Type of packets to mirror
    filter filter-name { # Firewall filter name
        term filter-term-name {
            from { # Do not specify match conditions based on route source address
            }
            then {
                port-mirror;
                accept;
            }
        }
    }
}