# Example: Configuring CLI-Based User-Specific Mirroring

This example shows the configuration of a CLI-based packet mirroring session for subscribers. . The mirroring session replicates all traffic associated with each user, and then sends the replicated traffic to the analyzer device.

1. Enable the visibility and use of the packet mirroring CLI commands.
   host1#mirror-enable
2. Create the analyzer interface and the route to the analyzer device.
   - For L2TP subscribers:
     host1(config)# interface tunnel ipsec:mirror3 transport-virtual-router default host1(config-if)#ip analyzer host1(config-if)#exit host1(config)#ip route 192.168.99.2 255.255.255.255 tunnel ipsec:mirror3
   - For DHCP and PPP subscribers:
     host1(config)# interface atm 4/0.1 host1(config-if)#ip address 19.0.0.2 255.255.255.0 host1(config-if)#ip analyzer host1(config-if)#exit host1(config)#ip route 19.0.0.2 255.255.255.255 101.101.101.2
3. Configure the secure policy that forwards the mirrored traffic to the analyzer device. The classifier-group command uses the default classifier list, which is indicated by the asterisk character (*).
   - For L2TP subscribers:
     host1(config)#secure l2tp policy-list l2tp_toMirrorHQ host1(config-policy-list)#classifier-group * host1(config-policy-list-classifier-group)#mirror analyzer-ip-address 192.168.99.2 analyzer-virtual-router default analyzer-udp-port 6500 mirror-identifier 1 session-identifier 1
   - For DHCP and PPP subscribers:
     host1(config)#secure ip policy-list secure-ipv4-policy host1(config-policy-list)#classifier-group * host1(config-policy-list-classifier-group)#mirror analyzer-ip-address 19.0.0.2 analyzer-virtual-router default analyzer-udp-port 2500 mirror-identifier 1 session-identifier 1
4. Configure packet mirroring for the subscriber and associate the secure policy with the user.
   - For L2TP subscribers:
     host1(config)#virtual-router lac host1:lac(config)#mirror username jwbooth@isptheatre.com l2tp secure-policy-list l2tp_toMirrorHQ
   - For DHCP and PPP subscribers:
     host1(config)#mirror dhcp-option-82 agent-circuit-id "x:12000004:circuit id:45" agent-remote-id "y:12000004:remote id:89" ip secure-policy-list secure-ipv4-policy host1(config)#mirror agent-circuit-id "x:12000001:pppoe agent circuit id:47" ip secure-policy-list secure-ipv4-policy host1(config)#mirror agent-remote-id hex 79:3a:02:00:00:02:3a:72:65:6d:6f:74:65:20:69:64:3a:35 ip secure-policy-list secure-ipv4-policy

   Now, when the subscriber logs in , the packet mirroring session starts and the subscriber’s replicated traffic is sent to the remote analyzer device.

5. Verify the packet-mirroring configuration.

       host1# show mirror subscribers
       Subscriber ID                                          ID         Secure       Secure         Mirrored
                                                            Method       Policy Type  Policy List    Sessions
       ------------------                                 ----------   -----------  ----------------  --------
       lac:jwbooth@isptheatre.com                            username         l2tp   l2tp_toMirrorHQ    1
       x:12000004:circuit id:45.y:12000004:remote id:89      dhcp-option-82   IP     secure-ipv4-policy 1
       x:12000001:pppoe agent circuit id:47                  agent-circuit-id IP     secure-ipv4-policy 1
       79:3a:02:00:00:02:3a:72:65:6d:6f:74:65:20:69:64:3a:35 agent-remote-id  IP     secure-ipv4-policy 1

6. Verify the configuration of the secure policy.

       host1# show secure policy-list
                                         Policy Table
                                         ------ -----
       Secure L2TP Policy l2tp_toMirrorHQ
        Administrative state: enable
        Reference count:      2
        Classifier control list: *
         mirror analyzer-ip-address 192.168.99.2 analyzer-virtual-router default analyzer-udp-port 6500 mirror-id 1 session-id 1
        Referenced by interface(s):
         TUNNEL l2tp:5/1/5  secure-input policy
         TUNNEL l2tp:5/1/5  secure-output policy

       Secure IP Policy secure-ipv4-policy
         Administrative state: enable
         Reference count:      6
         Classifier control list: *
       mirror analyzer-ip-address 19.0.0.2 analyzer-virtual-router default analyzer-udp-port 2500 mirror-identifier 1 session-identifier 1
       Referenced by interface(s):
        ip100.1.1.3  secure-input policy, statistics disabled, virtual-router default
        ip100.1.1.3  secure-output policy, statistics disabled, virtual-router default