Duplicate

The following scenarios demonstrate how to configure port mirroring using the traffic policy duplicate feature. Port mirroring duplicates network packets and forwards copies to monitoring destinations while preserving the original traffic flow. traffic selectors can be used to filter which packets should be duplicated based on protocol, addresses, or other criteria.

Test duplicate local traffic to an interface 

Description 

This scenario configures link-level port mirroring on DUT0’s (‘eth0’ interface). Both ingress (link-in) and egress (link-out) traffic policies are applied to duplicate all traffic to another physical interface.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy link-in DUP_POLICY
set interfaces ethernet eth0 traffic policy link-out DUP_POLICY
set interfaces ethernet eth2 address 20.0.0.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy DUP_POLICY rule 1 action accept
set traffic policy DUP_POLICY rule 1 duplicate device eth2

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth2 address 20.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 5: Ping the IP address 20.0.0.1 from DUT2:

admin@DUT2$ ping 20.0.0.1 count 1 size 56 timeout 1

Step 6: Modify the following configuration lines in DUT0 :

set service echo port 5050

Note

Start packet capture on DUT0 eth2 to monitor duplicated traffic

Step 7: Run the command monitor test connection client 10.0.0.1 5050 udp on DUT1.

Note

Now it is important to generate some traffic from DUT1 to DUT0 echo service.

Note

Stop packet capture. Expected output:

Test duplicate local traffic to a remote IP 

Description 

This scenario configures remote port mirroring on DUT0 (‘eth0’ interface). Local-in and local-out traffic policies duplicate traffic to a remote IP address. A traffic selector is configured to filter and duplicate only UDP traffic.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy local-in DUP_POLICY
set interfaces ethernet eth0 traffic policy local-out DUP_POLICY
set interfaces ethernet eth2 address 20.0.0.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy DUP_POLICY rule 1 action accept
set traffic policy DUP_POLICY rule 1 duplicate remote 20.0.0.2
set traffic policy DUP_POLICY rule 1 selector UDP_SEL
set traffic selector UDP_SEL rule 1 protocol udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth2 address 20.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 5: Ping the IP address 20.0.0.1 from DUT2:

admin@DUT2$ ping 20.0.0.1 count 1 size 56 timeout 1

Note

Start packet capture on DUT2 eth2 to monitor duplicated traffic

Step 6: Initiate a tcp connection from DUT1 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 5050 tcp
admin@DUT1$ monitor test connection client 10.0.0.1 5050 tcp

Step 7: Initiate a udp connection from DUT1 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 5050 udp
admin@DUT1$ monitor test connection client 10.0.0.1 5050 udp

Note

Stop packet capture. Expected output:

Note

Note that only UDP traffic is captured because the traffic selector is configured to filter UDP packets exclusively.

Test duplicate local traffic to a remote IP with VRF 

Description 

This scenario configures remote port mirroring on DUT0 (‘eth0’ interface). Local-in and local-out traffic policies duplicate traffic to a remote IP address. The interface is configured within a VRF, which must be specified as the output VRF. A traffic selector is configured to filter and duplicate only UDP traffic.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth0 traffic policy local-in DUP_POLICY
set interfaces ethernet eth0 traffic policy local-out DUP_POLICY
set interfaces ethernet eth2 address 20.0.0.1/24
set interfaces ethernet eth2 vrf VRF1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system vrf VRF1
set traffic policy DUP_POLICY rule 1 action accept
set traffic policy DUP_POLICY rule 1 duplicate remote 20.0.0.2 local-vrf VRF1
set traffic policy DUP_POLICY rule 1 selector UDP_SEL
set traffic selector UDP_SEL rule 1 protocol udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth2 address 20.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1

Step 5: Ping the IP address 20.0.0.1 from DUT2:

admin@DUT2$ ping 20.0.0.1 count 1 size 56 timeout 1

Note

Start packet capture on DUT2 eth2 to monitor duplicated traffic

Step 6: Initiate a tcp connection from DUT1 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 5050 tcp
admin@DUT1$ monitor test connection client 10.0.0.1 5050 tcp

Step 7: Initiate a udp connection from DUT1 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 5050 udp
admin@DUT1$ monitor test connection client 10.0.0.1 5050 udp

Note

Stop packet capture. Expected output:

Note

Note that only UDP traffic is captured because the traffic selector is configured to filter UDP packets exclusively.