Example for Configuring MQC-based Remote Traffic Mirroring

Procedure

1. Configure an observing port on SwitchA.

   # Configure GE1/0/2 of SwitchA as a Layer 2 remote observing port and bind the observing port to VLAN 10.

   <HUAWEI> system-view
   [HUAWEI] sysname SwitchA
   [SwitchA] observe-port 1 interface gigabitethernet 1/0/2 vlan 10     //Configure GE1/0/2 as Layer 2 remote observing port 1, and add it to VLAN 10.

   After the configuration is complete, the observing port forwards mirrored packets to VLAN 10 removing the need to add the observing port to the VLAN.

2. Configure a traffic classifier on SwitchA.

   # Create a traffic classifier c1 on SwitchA to match traffic with TCP port number WWW.

   [SwitchA] acl number 3000     //Create ACL 3000 to allow the packets with the TCP port number WWW to pass through.
   [SwitchA-acl-adv-3000] rule permit tcp destination-port eq www
   [SwitchA-acl-adv-3000] quit
   [SwitchA] traffic classifier c1     //Create a traffic classifier c1, and match ACL 3000.
   [SwitchA-classifier-c1] if-match acl 3000
   [SwitchA-classifier-c1] quit

3. Configure a traffic behavior on SwitchA.

   # Create a traffic behavior b1 on SwitchA, and define traffic mirroring in the traffic behavior to copy specified traffic to observing port GE1/0/2.

   [SwitchA] traffic behavior b1     //Create a traffic behavior b1, and define traffic mirroring to mirror specified traffic to observing port 1.
   [SwitchA-behavior-b1] mirroring to observe-port 1
   [SwitchA-behavior-b1] quit

   

   For fixed switches S6720-EI and S6720S-EI as well as cards (except X series cards) on modular switches, when configuring outbound traffic mirroring, do not configure other traffic behaviors (except the traffic statistics function of modular switches running V100R006 and earlier versions). From V200R001 to V200R010, the permit action generated by default when a traffic behavior is created on modular switches must also be deleted; otherwise, outbound traffic mirroring is ineffective.

4. Configure a traffic policy on SwitchA to apply it to an interface.

   # Create a traffic policy p1 on SwitchA, bind the traffic behavior and traffic classifier to the traffic policy, and apply the traffic policy to the inbound direction of GE1/0/1 to monitor traffic with a specified TCP port number.

   [SwitchA] traffic policy p1     //Create a traffic policy p1, and bind the traffic behavior and traffic classifier to the traffic policy.
   [SwitchA-trafficpolicy-p1] classifier c1 behavior b1
   [SwitchA-trafficpolicy-p1] quit
   [SwitchA] interface gigabitethernet 1/0/1
   [SwitchA-GigabitEthernet1/0/1] traffic-policy p1 inbound     //Apply the traffic policy to the inbound direction of GE1/0/1.
   [SwitchA-GigabitEthernet1/0/1] return

5. Create a VLAN on SwitchB and add ports to the VLAN.

   # Create VLAN 10 on SwitchB, disable MAC address learning in this VLAN, and add GE1/0/1 and GE1/0/2 to VLAN 10.

   

   Here, VLAN 10 is used for forwarding only mirrored packets. If VLAN 10 already exists and has learned MAC address entries, run the undo mac-address vlan vlan-id command in the system view to delete all MAC address entries in VLAN 10.

   <HUAWEI> system-view
   [HUAWEI] sysname SwitchB
   [SwitchB] vlan 10
   [SwitchB-vlan10] mac-address learning disable     //Disable MAC address learning in this VLAN.
   [SwitchB-vlan10] quit
   [SwitchB] interface gigabitethernet 1/0/1
   [SwitchB-GigabitEthernet1/0/1] port link-type access     //Set the link type of the interface on the monitoring device to access. The default link type of interfaces is not access.
   [SwitchB-GigabitEthernet1/0/1] port default vlan 10
   [SwitchB-GigabitEthernet1/0/1] quit
   [SwitchB] interface gigabitethernet 1/0/2
   [SwitchB-GigabitEthernet1/0/2] port link-type trunk     //Set the link type of the interface on the network side to trunk. The default link type of interfaces is not trunk.
   [SwitchB-GigabitEthernet1/0/2] port trunk allow-pass vlan 10
   [SwitchB-GigabitEthernet1/0/2] return

6. Verify the configuration.

   # Check the traffic classifier configuration.

   <SwitchA> display traffic classifier user-defined c1
     User Defined Classifier Information:
      Classifier: c1
       Precedence: 5
       Operator: OR
       Rule(s) : if-match acl 3000

   # Check the traffic policy configuration.

   <SwitchA> display traffic policy user-defined p1
     User Defined Traffic Policy Information:
     Policy: p1
      Classifier: c1
       Operator: OR
        Behavior: b1
         Mirroring  to observe-port 1

   # Check the observing port configuration.

   <SwitchA> display observe-port
     ----------------------------------------------------------------------
     Index          : 1
     Untag-packet   : No
     Interface      : GigabitEthernet1/0/2
     Vlan           : 10
     ----------------------------------------------------------------------

   # Check the mirrored port configuration.

   <SwitchA> display port-mirroring
     ----------------------------------------------------------------------
     Observe-port 1 : GigabitEthernet1/0/2
     ----------------------------------------------------------------------
     Stream-mirror:
     ----------------------------------------------------------------------
          Behavior               Direction  Observe-port
     ----------------------------------------------------------------------
     1    b1                     -          Observe-port 1
     ----------------------------------------------------------------------