2.5. Configuring Service Mirroring with CLI
This section provides information about service mirroring.
2.5.1. Mirror Configuration Overview
7210 SAS node mirroring can be organized in the following logical entities:
- The mirror source is defined as the location from where the traffic should be mirrored. A mirror source could be ingress of service entity or egress of a service entity. The list of mirror sources supported on a specific platform is listed preceding Mirror Source Port Requirements
- A SAP is defined in local mirror services as the mirror destination to where the mirrored packets are sent.
2.5.1.1. Defining Mirrored Traffic
In some scenarios, or when multiple services are configured on the same port, specifying the port does not provide sufficient resolution to separate traffic. In -Nokia’s implementation of mirroring, multiple source mirroring parameters can be specified to further identify traffic.
Mirroring of packets matching specific filter entries in an IP or MAC filter can be applied to refine what traffic is mirrored to flows of traffic within a service. The IP criteria can be combinations of:
- Source IP address/mask
- Destination IP address/mask
- IP Protocol value
- Source port value (for example, UDP or TCP port)
- Destination port value (for example, UDP or TCP port)
- DiffServ Code Point (DSCP) value
- ICMP code
- ICMP type
- IP fragments
- TCP ACK set/reset
- TCP SYN set/reset
The MAC criteria can be combinations of:
- IEEE 802.1p value/mask
- Source MAC address/mask
- Destination MAC address/mask
- Ethernet Type II Ethernet type value
 | Note: The list of packet fields that are available to match packets in IP and MAC ACLs for different platforms is different. For more information about the lists of packet fields available on different platforms, see the 7210 SAS-M, T, R6, R12, Mxp, Sx, S Router Configuration Guide. |
2.6. Basic Mirroring Configuration
Destination mirroring parameters must include at least:
- A mirror destination ID (same as the mirror source service ID).
- A mirror destination SAP.
Mirror source parameters must include at least:
- A mirror service ID (same as the mirror destination service ID).
- At least one source type (port, SAP, IP filter or MAC filter) specified.
The following is a sample local mirrored service (ALA-A) configuration output.
The following is a sample mirror source configuration output.
2.6.1. Mirror Classification Rules
-The Nokia implementation of mirroring can be performed by configuring parameters to select network traffic according to any of the entities in this section.
2.6.1.1. Port
The port command associates a port to a mirror source. The port is identified by the port ID. The defined port can be Ethernet or a Link Aggregation Group (LAG) ID. When a LAG ID is specified as the port ID, mirroring is enabled on all ports making up the LAG.
Mirror sources can be ports in either access or network mode. Port mirroring is supported in the combinations described in Table 8.
Table 8: Mirror Source Port Requirements
Port Type | Port Mode | Port Encapsulation Type |
faste/gige/10gige | access | null, dot1q and QinQ |
faste/gige/10gige | access uplink | qinq |
faste/gige/10gige | network | null/dot1q |
faste/gige/10gige | hybrid | null/dot1q/qinq |
2.6.1.2. SAP
More than one SAP can be associated within a single mirror source. Each SAP has its own ingress parameter keyword to define which packets are mirrored to the mirror-dest service ID. A SAP that is defined within a mirror destination cannot be used in a mirror source.
2.6.1.3. MAC filter
MAC filters are configured in the config>filter>mac-filter context. The mac-filter command causes all the packets matching the explicitly defined list of entry IDs to be mirrored to the mirror destination specified by the service-id of the mirror source.
2.6.1.4. IP filter
IP filters are configured in the config>filter>ip-filter context. The ip-filter command causes all the packets matching the explicitly defined list of entry IDs to be mirrored to the mirror destination specified by the service-id of the mirror source.
Ingress mirrored packets are mirrored to the mirror destination before any ingress packet modifications.
| Note: An IP filter cannot be applied to a mirror destination SAP. |
2.7. Common Configuration Tasks
This section provides a brief overview of the tasks that must be performed to configure local mirror services and provides CLI command syntax. Note that the local mirror source and mirror destination components must be configured under the same service ID context.
Each local mirrored service (Figure 5) (within the same router) requires the following configurations:
- Specify mirror destination (SAP).
- Specify mirror source (port, SAP, IP filter, MAC filter).
Figure 5: Local Mirrored Service Tasks
2.7.1. Configuring a Local Mirror Service
To configure a local mirror service, the source and destinations must be located on the same router. Note that local mirror source and mirror destination components must be configured under the same service ID context.
The mirror-source commands are used as traffic selection criteria to identify traffic to be mirrored at the source. Each of these criteria are independent. For example, use the debug>mirror-source>port {port-id | lag lag-id} {[egress] [ingress]} command and debug>mirror-source ip-filter ip-filter-id entry entry-id [entry-id…] command to capture (mirror) traffic that matches a specific IP filter entry and traffic ingressing and egressing a specific port. A filter must be applied to the SAP or interface if only specific packets are to be mirrored.
Use the following syntax to configure one or more mirror source parameters.
The mirror-dest commands are used to specify where the mirrored traffic is to be sent. Use the following syntax to configure mirror destination parameters.
The following is a sample local mirrored service using a NULL SAP configuration output. On ALA-A, mirror service 103 is mirroring traffic matching IP filter 2, entry 1 as well as egress and ingress traffic on port 1/1/23 and sending the mirrored packets to SAP 1/1/24
The following is a sample local mirrored service using a dot1q SAP configuration output. User needs to configure a front-panel port for use with the mirroring application when the mirror destination is a Dot1q SAP or a Q1.* SAP, as follows.
The following is sample debug mirroring information.
2.7.2. Configuring a Remote Mirror Service
The source and destination are configured on different routers for remote mirroring. Note that mirror source and mirror destination parameters must be configured under the same service ID context.
| Note: Remote mirroring using MPLS SDP is supported on all 7210 SAS platforms as described in this document, except those operating in access-uplink mode. |
The mirror-source commands are used as traffic selection criteria to identify traffic to be mirrored at the source. For example, use the port port-id [lag-id] {[egress] [ingress]} and mac-filter mac-filter-id entry entry-id [entry-id …] commands.
Use the syntax to configure one or more mirror source parameters.
The mirror-dest commands are used to specify where the mirrored traffic is to be sent, the forwarding class, and the size of the packet. Use the following syntax to configure mirror destination parameters.
Figure 6 shows the mirror destination, which is on ALA-A, configuration for mirror service 1216. This configuration specifies that the mirrored traffic coming from the mirror source (10.10.0.91) is to be directed to SAP /1/58 and states that the service only accepts traffic from far end 10.10.0.92 (ALA-B) with an ingress service label of 5678. When a forwarding class is specified, then all mirrored packets transmitted to the destination SAP or SDP override the default (be) forwarding class.
Figure 6: Remote Mirrored Service Tasks
The following example displays the CLI output showing the configuration of remote mirrored service 1216. The traffic ingressing and egressing port 1/1/60 on 10.10.0.92 (ALA-B) will be mirrored to the destination SAP 1/1/58:0 on ALA-A.
The following is a sample remote mirror destination configuring the front panel port with mirroring application.
The following is a sample mirror destination configuration output for mirror service 1216 on ALA-A.
The following is a sample remote mirror destination output configured on ALA-B.
The following is a sample mirror source configuration output for ALA-B.
The following is a sample SDP configuration output from ALA-A to ALA-B (SDP 2) and the SDP configuration output from ALA-B to ALA-A (SDP 4).
2.8. Service Management Tasks
This section describes the service management tasks.
The following shows the command usage to modify an existing mirrored service.
2.8.1. Modifying a Local Mirrored Service
Existing mirroring parameters can be modified in the CLI. The changes are applied immediately. The service must be shut down if changes to the SAP are made.
The following shows the command usage to modify parameters for a basic local mirroring service.
The following is a sample of the local mirrored service modifications.
2.8.2. Deleting a Local Mirrored Service
Existing mirroring parameters can be deleted in the CLI. A shutdown must be issued on a service level to delete the service. It is not necessary to shut down or remove SAP or port references to delete a local mirrored service.
The following shows the command usage to delete a local mirrored service.
2.8.3. Modifying a Remote Mirrored Service
Existing mirroring parameters can be modified in the CLI. The changes are applied immediately. The service must be shut down if changes to the SAP are made.
In the following example, the mirror destination is changed from 10.10.10.2 (ALA-B) to 10.10.10.3 (SR3). Note that the mirror-dest service ID on ALA-B must be shut down first before it can be deleted.
The following shows the command usage to modify parameters for a remote mirrored service.
2.8.4. Deleting a Remote Mirrored Service
Existing mirroring parameters can be deleted in the CLI. A shut down must be issued on a service level to delete the service. It is not necessary to shut down or remove SAP, or far-end references to delete a remote mirrored service.
To delete a mirror service, the spoke-SDP service has to be deleted from the service. Mirror destinations must be shut down first before they are deleted.
The mirror-destination service ID 105 was removed from the configuration on ALA-A and ALA-B, therefore, does not appear in the info command output.
Since the mirror destination was removed from the configuration on ALA-B, the port information was automatically removed from the debug mirror-source configuration.