Troubleshooting Port Mirroring

Port Mirroring Constraints and Limitations

• Local and Remote Port Mirroring
• Remote Port Mirroring Only

Local and Remote Port Mirroring

• You can create a total of four port-mirroring configurations on a QFX Series standalone switch.
• You can create a total of four port-mirroring configurations on each Node group in a QFabric system, subject to the following constraints:
  • As many as four of the configurations can be for local port mirroring.
  • As many as three of the configurations can be for remote port mirroring.
• Regardless of whether you are configuring a standalone switch or a Node group, the following limits apply:
  • There can be no more than two configurations that mirror ingress traffic. (If you configure a firewall filter to send traffic to a port mirror—that is, you use the analyzer action modifier in a filter term—this counts as an ingress mirroring configuration for switch or Node group on which the filter is applied.)
  • There can be no more than two configurations that mirror egress traffic.

Note: On QFabric systems, there is no system-wide limit on the total number of mirror sessions.

• You can configure no more than one type of output in one port-mirroring configuration. That is, you can use no more than one of the following to complete a set analyzer name output statement:
  • interface
  • ip-address
  • vlan
• If you configure Junos OS to mirror egress packets, do not configure more than 2000 VLANs on a QFX3500 device or QFabric system. If you do so, some VLAN packets might contain incorrect VLAN IDs. This applies to any VLAN packets—not only the mirrored copies.
• The ratio and loss-priority options are not supported.
• Packets with physical layer errors are filtered out and are not sent to the output port or VLAN.
• If you use sFlow monitoring to sample traffic, it does not sample the mirror copies when they exit from the output interface.

• You cannot mirror packets exiting or entering the following ports:

  • Dedicated Virtual Chassis interfaces
  • Management interfaces (me0 or vme0)
  • Fibre Channel interfaces
  • Routed VLAN interfaces
• An aggregated Ethernet interface cannot be an output interface.
• Do not include an 802.1Q subinterface that has a unit number other than 0 in a port mirroring configuration. Port mirroring does not work with subinterfaces if their unit number is not 0. (You configure 802.1Q subinterfaces using the vlan-tagging statement.)
• When packet copies are sent out the output interface, they are not modified for any changes that are normally applied on egress, such as CoS rewriting.
• An interface can be the input interface for only one mirroring configuration. Do not use the same interface as the input interface for multiple mirroring configurations.
• CPU-generated packets (such as ARP or ICMP packets) cannot be mirrored on egress.
• (QFabric systems only) If you configure a QFabric analyzer to mirror egress traffic and the input and output interfaces are on different Node devices, the mirrored copies have incorrect VLAN IDs. This limitation does not apply if you configure a QFabric analyzer to mirror egress traffic and the input and output interfaces are on the same Node device. In this case the mirrored copies have the correct VLAN IDs (as long as you do not configure more than 2000 VLANs on the QFabric system).

Remote Port Mirroring Only

• If you configure an output IP address, the address cannot be in the same subnetwork as any of the switch’s management interfaces.
• If you create virtual routing instances and also create an analyzer configuration that includes an output IP address, the output address belongs to the default virtual routing instance (inet.0 routing table).
• An output VLAN cannot be a private VLAN or VLAN range.
• An output VLAN cannot be shared by multiple analyzer statements.
• An output VLAN interface cannot be a member of any other VLAN.
• An output VLAN interface cannot be an aggregated Ethernet interface.
• On the source (monitored) switch, only one interface can be a member of the analyzer VLAN.

Egress Port Mirroring with VLAN Translation

Problem

If you create a port-mirroring configuration that mirrors customer VLAN (CVLAN) traffic on egress and the traffic undergoes VLAN translation before being mirrored, the VLAN translation does not apply to the mirrored packets. That is, the mirrored packets retain the service VLAN (SVLAN) tag that should be replaced by the CVLAN tag on egress. The original packets are unaffected—on these packets VLAN translation works properly, and the SVLAN tag is replaced with the CVLAN tag on egress.

Solution

This is expected behavior.

Egress Port Mirroring with Private VLANs

Problem

If you create a port-mirroring configuration that mirrors private VLAN (PVLAN) traffic on egress, the mirrored traffic (the traffic that is sent to the analyzer system) has the VLAN tag of the ingress VLAN instead of the egress VLAN. For example, assume the following PVLAN configuration:

• Promiscuous trunk port that carries primary VLANs pvlan100 and pvlan400.
• Isolated access port that carries secondary VLAN isolated200. This VLAN is a member of primary VLAN pvlan100.
• Community port that carries secondary VLAN comm300. This VLAN is also a member of primary VLAN pvlan100.
• Output interface (monitor interface) that connects to the analyzer system. This interface forwards the mirrored traffic to the analyzer.

If a packet for pvlan100 enters on the promiscuous trunk port and exits on the isolated access port, the original packet is untagged on egress because it is exiting on an access port. However, the mirror copy retains the tag for pvlan100 when it is sent to the analyzer.

Here is another example: If a packet for comm300 ingresses on the community port and egresses on the promiscuous trunk port, the original packet carries the tag for pvlan100 on egress, as expected. However, the mirrored copy retains the tag for comm300 when it is sent to the analyzer.

Solution

This is expected behavior.