Example for Configuring Layer 2 Remote VLAN Mirroring

Networking Requirements

In Figure 1, all the hosts of a company access the Internet through SwitchA. The monitoring device (Server) is connected to SwitchA through SwitchB.

Internet-bound traffic from all the hosts in VLAN 10 needs to be monitored by the Server.

Figure 1 Layer 2 remote VLAN mirroring networking

Configuration Roadmap

The configuration roadmap is as follows:

Create VLAN 10 and 20 on SwitchA and add the ports connected to hosts to VLAN 10 and 20 respectively so that the hosts can communicate with SwitchA at Layer 2.
Create VLAN 30 on SwitchB, disable MAC address learning in VLAN 30, and add the ports connected to SwitchA and the Server to VLAN 30 so that SwitchB can communicate with SwitchA and the Server at Layer 2.
Configure GE0/0/3 of SwitchA as a Layer 2 remote observing port to forward mirrored traffic.
Configure VLAN mirroring to copy Internet-bound traffic from all the hosts in VLAN 10 and send the traffic to the Layer 2 remote observing port.

Procedure

Add ports to VLANs.

# Create VLAN 10 and 20 on the Switch and add GE0/0/1 and GE0/0/2 to VLAN 10 and 20 respectively.

<HUAWEI> system-view
[HUAWEI] sysname SwitchA
[SwitchA] vlan batch 10
[SwitchA] interface gigabitethernet 0/0/1
[SwitchA-GigabitEthernet0/0/1] port link-type access
[SwitchA-GigabitEthernet0/0/1] port default vlan 10
[SwitchA-GigabitEthernet0/0/1] quit
[SwitchA] interface gigabitethernet 0/0/2
[SwitchA-GigabitEthernet0/0/2] port link-type access
[SwitchA-GigabitEthernet0/0/2] port default vlan 20
[SwitchA-GigabitEthernet0/0/2] quit

# Create VLAN 20 on SwitchB and add GE0/0/1 and GE0/0/4 to VLAN 20.

VLAN 30 is used for forwarding only mirrored traffic. If VLAN 30 already exists and has learned MAC address entries, run the undo mac-address vlan vlan-id command in the system view to delete all MAC address entries in VLAN 30.

<HUAWEI> system-view
[HUAWEI] sysname SwitchB
[SwitchB] vlan 30
[SwitchB-vlan30] mac-address learning disable
[SwitchB-vlan30] quit
[SwitchB] interface gigabitethernet 0/0/1
[SwitchB-GigabitEthernet0/0/1] port link-type access
[SwitchB-GigabitEthernet0/0/1] port default vlan 30
[SwitchB-GigabitEthernet0/0/1] quit
[SwitchB] interface gigabitethernet 0/0/2
[SwitchB-GigabitEthernet0/0/2] port link-type trunk
[SwitchB-GigabitEthernet0/0/2] port trunk allow-pass vlan 30
[SwitchB-GigabitEthernet0/0/2] return

Configure an observing port.
# Configure GE0/0/3 of SwitchA as a Layer 2 remote observing port.
```
[SwitchA] observe-port 1 interface gigabitethernet 0/0/3 vlan 30
```
# Disable the observing port from forwarding data packets.
```
[SwitchA] observe-port 1 forwarding disable
```
Configure VLAN mirroring.
# On SwitchA, copy the packets received by all the active ports in VLAN 10 to the Layer 2 remote observing port.
```
[SwitchA] vlan 10
[SwitchA-vlan10] mirroring to observe-port 1 inbound
[SwitchA-vlan10] return
```

Verify the configuration.

# Check the observing port configuration.

<SwitchA> display observe-port
  ----------------------------------------------------------------------
  Index          : 1
  Untag-packet   : No
  Forwarding     : No
  Interface      : GigabitEthernet0/0/3
  Vlan           : 30
  ----------------------------------------------------------------------

# Check the mirroring configuration.

<SwitchA> display port-mirroring
  ----------------------------------------------------------------------
  Observe-port 1 : GigabitEthernet0/0/3
  ----------------------------------------------------------------------
  Vlan-mirror:
  ----------------------------------------------------------------------
  Mirror-vlan              Direction     Observe-port
  ----------------------------------------------------------------------
  10                       Inbound       Observe-port 1
  ----------------------------------------------------------------------