Resolving and Tracking the Analyzer Device’s Address

During the packet mirroring configuration process, you specify the IP address of the analyzer device to which the mirrored traffic is sent. For CLI-based packet mirroring, you use the mirror analyzer-ip-address command to specify the IP address. For RADIUS-based packet mirroring, the RADIUS attribute Med-IP-Address [26-60] is the address of the analyzer device.

After configuration is complete, the router performs a route lookup to resolve the analyzer device’s address and to ensure that traffic can be forwarded to the analyzer device for analysis. However, the analyzer device is considered unreachable if the router’s analyzer interface is not in analyzer mode, is not yet created, or if the routes to the analyzer device are absent

If the analyzer device is unreachable, then the mirror action in the secure policy is disabled, and no packets are mirrored. The show secure policy-list command output indicates that the mirror action is disabled and the analyzer device is unreachable.

The router tracks the analyzer device’s IP address for any route changes within the router. This tracking ability provides a degree of failure recovery by enabling you to configure multiple analyzer interfaces to serve as redundant ports to reach the analyzer device.