H3C端口镜像配置举例
合集下载
相关主题
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
4 多台源设备镜像配置举例
4.1 组网需求
如 图 2 所示，用户只有一台分析仪，但希望能够监控分析来自互联网和局域网的流量。使用的三 台Device均为二层设备。为实现对流量的准确分析，要求避免来自互联网和局域网的流量互相影 响。 图2 多台源设备镜像配置组网图
4.2 配置思路
由于是跨设备镜像，且源设备与目的设备都为二层设备，因此必须配置二层远程端口镜像。为了 防止互联网和局域网的流量互相影响，Device A 和 Device B 要使用不同的远程镜像 VLAN。 在 Device C 上，Device A 和 Device B 的不同远程镜像 VLAN 对应同一个目的端口。由于一个远 程镜像组只能配置一个远程镜像 VLAN，并且同一个目的端口不能配置在两个镜像组内。因此在
port link-mode bridge mirroring-group 1 reflector-port # interface Ethernet1/3 port link-mode bridge port access vlan 2 # interface Ethernet1/4 port link-mode bridge port access vlan 2 #
# 创建 VLAN 2。
[DeviceA] vlan 2 [DeviceA-vlan2] quit
# 为远程源镜像组配置远程镜像 VLAN、源端口和反射口。
1Hale Waihona Puke Baidu
3.2 配置思路
本例中的一个源端口和两个目的端口都位于同一台设备上，所以应优先考虑采用本地端口镜像方 式。但一个本地镜像组内不允许有两个目的端口，所以需配置两个本地镜像组，而一个源端口又 不能同时属于两个本地镜像组，所以此方式无法实现本例的需求。 在这种情况下，可借助二层远程端口镜像的反射端口方式实现需求：利用反射端口会在远程镜像 VLAN 中广播镜像报文的原理，将两个目的端口都加入远程镜像 VLAN 即可。
3
Device C 上，不能通过配置远程镜像组将不同远程镜像 VLAN 的流量送至分析器，而要通过配置 连接分析仪的端口允许不同远程镜像 VLAN 通过来达到该目的。
4.3 配置步骤
4.3.1 Device A的配置
(1) 配置远程源镜像组 # 创建远程源镜像组 1。
<DeviceA> system-view [DeviceA] mirroring-group 1 remote-source
4.3.1 Device A的配置 ························································································································· 4 4.3.2 Device B的配置 ························································································································· 4 4.3.3 Device C的配置 ························································································································· 5 4.4 验证配置 ··············································································································································· 5 4.5 配置文件 ··············································································································································· 6
3 多个目的端口配置举例
3.1 组网需求
如 图 1 所示，用户有两台监控分析设备，一台是分析仪，另一台是IDS（Intrusion Detection System，入侵检测系统）设备。用户希望能对来自互联网的流量同时进行分析和入侵检测。本组 网中的Device设备不支持一个端口被多个本地镜像组用作源端口。 图1 多个目的端口配置组网图
(2) 在远程镜像 VLAN 中添加监控端口 # 将端口 Ethernet1/3 加入远程镜像 VLAN。
[Device] interface ethernet 1/3 [Device-Ethernet1/3] port access vlan 2 [Device-Ethernet1/3] quit
i
1 简介
本文档介绍通过端口镜像进行数据监控的典型配置举例。 在端口镜像的实际应用中，可以通过灵活配置实现不同的组网需求，比如一个源端口的数据可以 镜像到多个目的端口，或者多个源端口的数据镜像到一个目的端口。
2 配置前提
本文档不严格与具体软、硬件版本对应，如果使用过程中与产品实际情况有差异，请参考相关产 品手册，或以设备实际情况为准。 本文档中的配置均是在实验室环境下进行的配置和验证，配置前设备的所有参数均采用出厂时的 缺省配置。如果您已经对设备进行了配置，为了保证配置效果，请确认现有配置和以下举例中的 配置不冲突。 本文档假设您已了解端口镜像特性。
3.3 配置步骤
(1) 配置远程源镜像组 # 创建远程源镜像组。
<Device> system-view [Device] mirroring-group 1 remote-source
# 创建 VLAN 2。
[Device] vlan 2 [Device-vlan2] quit
# 为远程源镜像组配置远程镜像 VLAN、源端口和反射口。
[Device] mirroring-group 1 remote-probe vlan 2 [Device] mirroring-group 1 mirroring-port ethernet 1/1 inbound [Device] mirroring-group 1 reflector-port ethernet 1/2
3.5 配置文件
# mirroring-group 1 remote-source mirroring-group 1 remote-probe vlan 2
# vlan 1 # vlan 2 # interface Ethernet1/1
port link-mode bridge 2
mirroring-group 1 mirroring-port inbound # interface Ethernet1/2
# 将端口 Ethernet1/4 加入远程镜像 VLAN。
[Device] interface ethernet 1/4 [Device-Ethernet1/4] port access vlan 2
3.4 验证配置
用户在两台监控分析设备上可以同时收到来自互联网的流量，镜像功能生效。这样，用户就可以 对互联网的流量分别进行综合分析和入侵检测了。
3.1 组网需求 ··············································································································································· 1 3.2 配置思路 ··············································································································································· 2 3.3 配置步骤 ··············································································································································· 2 3.4 验证配置 ··············································································································································· 2 3.5 配置文件 ··············································································································································· 2 4 多台源设备镜像配置举例 ······················································································································ 3 4.1 组网需求 ··············································································································································· 3 4.2 配置思路 ··············································································································································· 3 4.3 配置步骤 ··············································································································································· 4
端口镜像配置举例
Copyright © 2013 杭州华三通信技术有限公司 版权所有，保留一切权利。 非经本公司书面许可，任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部， 并不得以任何形式传播。本文档中的信息可能变动，恕不另行通知。
目录
1 简介 ······················································································································································ 1 2 配置前提 ··············································································································································· 1 3 多个目的端口配置举例·························································································································· 1
4.1 组网需求
如 图 2 所示，用户只有一台分析仪，但希望能够监控分析来自互联网和局域网的流量。使用的三 台Device均为二层设备。为实现对流量的准确分析，要求避免来自互联网和局域网的流量互相影 响。 图2 多台源设备镜像配置组网图
4.2 配置思路
由于是跨设备镜像，且源设备与目的设备都为二层设备，因此必须配置二层远程端口镜像。为了 防止互联网和局域网的流量互相影响，Device A 和 Device B 要使用不同的远程镜像 VLAN。 在 Device C 上，Device A 和 Device B 的不同远程镜像 VLAN 对应同一个目的端口。由于一个远 程镜像组只能配置一个远程镜像 VLAN，并且同一个目的端口不能配置在两个镜像组内。因此在
port link-mode bridge mirroring-group 1 reflector-port # interface Ethernet1/3 port link-mode bridge port access vlan 2 # interface Ethernet1/4 port link-mode bridge port access vlan 2 #
# 创建 VLAN 2。
[DeviceA] vlan 2 [DeviceA-vlan2] quit
# 为远程源镜像组配置远程镜像 VLAN、源端口和反射口。
1Hale Waihona Puke Baidu
3.2 配置思路
本例中的一个源端口和两个目的端口都位于同一台设备上，所以应优先考虑采用本地端口镜像方 式。但一个本地镜像组内不允许有两个目的端口，所以需配置两个本地镜像组，而一个源端口又 不能同时属于两个本地镜像组，所以此方式无法实现本例的需求。 在这种情况下，可借助二层远程端口镜像的反射端口方式实现需求：利用反射端口会在远程镜像 VLAN 中广播镜像报文的原理，将两个目的端口都加入远程镜像 VLAN 即可。
3
Device C 上，不能通过配置远程镜像组将不同远程镜像 VLAN 的流量送至分析器，而要通过配置 连接分析仪的端口允许不同远程镜像 VLAN 通过来达到该目的。
4.3 配置步骤
4.3.1 Device A的配置
(1) 配置远程源镜像组 # 创建远程源镜像组 1。
<DeviceA> system-view [DeviceA] mirroring-group 1 remote-source
4.3.1 Device A的配置 ························································································································· 4 4.3.2 Device B的配置 ························································································································· 4 4.3.3 Device C的配置 ························································································································· 5 4.4 验证配置 ··············································································································································· 5 4.5 配置文件 ··············································································································································· 6
3 多个目的端口配置举例
3.1 组网需求
如 图 1 所示，用户有两台监控分析设备，一台是分析仪，另一台是IDS（Intrusion Detection System，入侵检测系统）设备。用户希望能对来自互联网的流量同时进行分析和入侵检测。本组 网中的Device设备不支持一个端口被多个本地镜像组用作源端口。 图1 多个目的端口配置组网图
(2) 在远程镜像 VLAN 中添加监控端口 # 将端口 Ethernet1/3 加入远程镜像 VLAN。
[Device] interface ethernet 1/3 [Device-Ethernet1/3] port access vlan 2 [Device-Ethernet1/3] quit
i
1 简介
本文档介绍通过端口镜像进行数据监控的典型配置举例。 在端口镜像的实际应用中，可以通过灵活配置实现不同的组网需求，比如一个源端口的数据可以 镜像到多个目的端口，或者多个源端口的数据镜像到一个目的端口。
2 配置前提
本文档不严格与具体软、硬件版本对应，如果使用过程中与产品实际情况有差异，请参考相关产 品手册，或以设备实际情况为准。 本文档中的配置均是在实验室环境下进行的配置和验证，配置前设备的所有参数均采用出厂时的 缺省配置。如果您已经对设备进行了配置，为了保证配置效果，请确认现有配置和以下举例中的 配置不冲突。 本文档假设您已了解端口镜像特性。
3.3 配置步骤
(1) 配置远程源镜像组 # 创建远程源镜像组。
<Device> system-view [Device] mirroring-group 1 remote-source
# 创建 VLAN 2。
[Device] vlan 2 [Device-vlan2] quit
# 为远程源镜像组配置远程镜像 VLAN、源端口和反射口。
[Device] mirroring-group 1 remote-probe vlan 2 [Device] mirroring-group 1 mirroring-port ethernet 1/1 inbound [Device] mirroring-group 1 reflector-port ethernet 1/2
3.5 配置文件
# mirroring-group 1 remote-source mirroring-group 1 remote-probe vlan 2
# vlan 1 # vlan 2 # interface Ethernet1/1
port link-mode bridge 2
mirroring-group 1 mirroring-port inbound # interface Ethernet1/2
# 将端口 Ethernet1/4 加入远程镜像 VLAN。
[Device] interface ethernet 1/4 [Device-Ethernet1/4] port access vlan 2
3.4 验证配置
用户在两台监控分析设备上可以同时收到来自互联网的流量，镜像功能生效。这样，用户就可以 对互联网的流量分别进行综合分析和入侵检测了。
3.1 组网需求 ··············································································································································· 1 3.2 配置思路 ··············································································································································· 2 3.3 配置步骤 ··············································································································································· 2 3.4 验证配置 ··············································································································································· 2 3.5 配置文件 ··············································································································································· 2 4 多台源设备镜像配置举例 ······················································································································ 3 4.1 组网需求 ··············································································································································· 3 4.2 配置思路 ··············································································································································· 3 4.3 配置步骤 ··············································································································································· 4
端口镜像配置举例
Copyright © 2013 杭州华三通信技术有限公司 版权所有，保留一切权利。 非经本公司书面许可，任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部， 并不得以任何形式传播。本文档中的信息可能变动，恕不另行通知。
目录
1 简介 ······················································································································································ 1 2 配置前提 ··············································································································································· 1 3 多个目的端口配置举例·························································································································· 1