交换机M:N端口镜像配置
昨天,在BBS上看到有问“怎样做镜像分流”的,原因是现网环境下,需要旁路部署的安全设备越来越多,交换机上需要将流量镜像到多个目标端口/监视端口。
交换机要进行M:N的端口镜像,从配置上来讲,也是一个M:1的端口镜像,只是这个“1”是1个特殊端口,称为“反射端口”,再通过这个特殊端口,将流量引入由N个端口组成的另一个“1”,1个VLAN,加入这个VLAN的接口就都能接收到镜像的流量了。
不多说了,直接贴出设备的相关配置。
锐捷交换机配置:
S12010#sh runn version RGOS 10.4(3b17)p3T49Release(217732)(Fri Jan 5 10:05:13 CST2018 -ngcf63) vlan 4050 remote-span ! interface GigabitEthernet 1/1/19 switchport mode trunk switchport trunk allowed vlan remove 4050 //Trunk接口裁减掉镜像流量的VLAN ! interface GigabitEthernet 1/7/28 switchport access vlan 4050 //加入VLAN的接口可以接收镜像流量 ! interface AggregatePort 6 switchport mode trunk switchport trunk allowed vlan remove 4050 //Trunk接口裁减掉镜像流量的VLAN ! monitor session 3 remote-source monitor session 3 destination remote vlan4050 interfaceGigabitEthernet 2/8/12 monitor session 3 source interfaceAggregatePort 6 both //加入镜像源端口 ......
H3C V5交换机配置:
[HXSW]disp cur version 5.20, Release 6708P03 # mirroring-group 1 remote-source mirroring-group 1 remote-probe vlan999 # vlan 999 # interface Bridge-Aggregation10 portlink-type trunk porttrunk permit vlan 1 to 998 1000 to 4094 //Trunk接口裁减掉镜像流量的VLAN # interface GigabitEthernet1/2/0/13 portaccess vlan 999 # interface GigabitEthernet1/2/0/14 portaccess vlan 999 # interface GigabitEthernet1/3/0/1 mirroring-group1 mirroring-port inbound # interface GigabitEthernet1/3/0/2 mirroring-group1 mirroring-port inbound #
H3C V7交换机配置:
[core]disp cur version7.1.070, Release 7536P05 # mirroring-group1 local mirroring-group 2 local # interface GigabitEthernet1/2/0/1 mirroring-group 1 mirroring-port both mirroring-group 2 mirroring-port both # interface GigabitEthernet1/2/0/2 mirroring-group 1 mirroring-port both mirroring-group 2 mirroring-port both # interface GigabitEthernet2/2/0/43 mirroring-group 1 monitor-port # interface GigabitEthernet2/2/0/44 mirroring-group 2 monitor-port #
|