Mirroring can be performed based on the following criteria:
Configuring mirroring is like creating a unidirection service. Mirroring requires the configuration of:
- mirror source
- the traffic on specific points to mirror
- mirror destination
- the location to send the mirrored traffic, where the sniffer is to be located
Figure: Local mirroring example shows a local mirror service configured on ALA-A.
Port 2/1/2 is specified as the source. Mirrored traffic ingressing and egressing this port is sent to port 2/1/3.
SAP 2/1/3 is specified as the destination. The sniffer is physically connected to this port. Mirrored traffic ingressing and egressing port 2/1/2 is sent here. SAP, encapsulation requirements, packet slicing, and mirror classification parameters are configured. SDPs are not used in local mirroring.
Figure: Local mirroring example
Figure: Remote mirroring example shows a remote mirror service configured as ALA B as the mirror source and ALA A as the mirror destination. Mirrored traffic ingressing and egressing port 5/2/1 (the source) on ALA B is handled the following ways:
-
Port 5/2/1 is specified as the mirror source port. Parameters are defined to select specific traffic ingressing and egressing this port.
-
Destination parameters are defined to specify where the mirrored traffic is to be sent. In this case, mirrored traffic is sent to a SAP configured as part of the mirror service on port 3/1/3 on ALA A (the mirror destination).
-
ALA A decodes the service ID and sends the traffic out of port 3/1/3.
-
The sniffer is physically connected to this port (3/1/3). SAP, encapsulation requirements, packet slicing, and mirror classification parameters are configured in the destination parameters.
Figure: Remote mirroring example
Figure: Mirror configuration and implementation flow shows the process to provision basic mirroring parameters.
Figure: Lawful intercept configuration and implementation flow shows the process to provision LI parameters.
