Configuring Scopes When Mirroring Traffic

You configure scopes to define the services to be activated for a specific SRC-managed network. Which scopes you configure depends on how you direct traffic to an IDP sensor.

In a network that contains both JUNOSe routers and JUNOS routing platforms, you can assign a single scope to all routers, and a second scope to only JUNOS routing platforms. Figure 12 shows the scopes and routers configured in the sample data. The Junos POP scope contains the aggregate and fragment services. The Junos POP1 scope defines the list of JUNOS routing platforms that provide the mirroring service for the subscriber access router.

Figure 12: Scopes to Support Mirroring Traffic to an IDP Sensor

To mirror traffic from a JUNOS routing platform to an IDP sensor:

1. Create a general JUNOS POP scope.
2. Assign the scope to the virtual routers on the JUNOSe subscriber access router and the JUNOS routing platforms. Make sure that these routers appear under o=Networks, o=umc in the directory. You create the aggregate service in this scope.

   For a sample scope for JUNOS routing platforms, see l=IDP-JunosPop, o=Scopes, o=umc in the sample data.

3. Create a network-specific JUNOS scope that is associated with the general JUNOS scope for each specific POP.

   To show the relationship between the two types of JUNOS scopes, we recommend that you incorporate the name of the general JUNOS scope into the name of the network-specific scope. For example, if the name of the general JUNOS scope is JunosPop, then the names of network-specific scopes are JunosPop1, JunosPop2, and so on.

   A network-specific scope must contain a parameter that lists the names of the JUNOS routers in the JUNOS POP. By using this list, the SRC software activates the services in the JUNOS scope for each router listed.

For an example of a network-specific scope, see l=IDP-JunosPop1, o=Scopes, o=umc in the sample data.

Copyright © 2009, Juniper Networks, Inc. All rights reserved. Trademark Notice.