H3C S7500 Series Operating instructions

Brand: H3C

Model: S7500 Series

Type: Operating instructions

H3C S7500 Series, a high-performance Ethernet switch, is designed for large and medium-sized campus networks and data centers. It offers various capabilities to enhance network performance and security. With its comprehensive Layer 2 and Layer 3 features, including routing, multicast, and QoS, the H3C S7500 can handle complex network traffic and provide reliable connectivity. Additionally, its support for advanced features like MPLS, VPLS, and IPv6 makes it suitable for service provider networks.

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Table of Contents

Table of Contents

Chapter 1 Mirroring Configuration ..............................................................................................1-1

1.1 Overview............................................................................................................................1-1

1.1.1 Port Mirroring...........................................................................................................1-1

1.1.2 Remote Port Mirroring.............................................................................................1-1

1.1.3 Traffic Mirroring.......................................................................................................1-4

1.1.4 Remote Traffic Mirroring .........................................................................................1-4

1.2 Mirroring Supported by S7500...........................................................................................1-5

1.3 Mirroring Configuration......................................................................................................1-5

1.3.1 Configuring Port Mirroring.......................................................................................1-5

1.3.2 Configuring Remote Port Mirroring .........................................................................1-7

1.3.3 Configuring Traffic Mirroring.................................................................................. 1-13

1.3.4 Configuring Remote Traffic Mirroring.................................................................... 1-16

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-1

Chapter 1 Mirroring Configuration

When configuring mirroring, go to these sections for information you are interested in:

z Overview

z Mirroring Supported by S7500

z Mirroring Configuration

1.1 Overview

Mirroring refers to the process of copying packets that meet the specified rules to a

destination port. Generally, a destination port is connected to a data detect device,

through which users can analyze the mirrored packets for monitoring and

troubleshooting the network.

Data detect device

Network

Source port

Destination po

Figure 1-1 Mirrorin

1.1.1 Port Mirroring

Port mirroring refers to the process of copying the packets received or sent by the

specified port to the specified local port.

1.1.2 Remote Port Mirroring

Remote port mirroring eliminates the limitation that the source port and the destination

port must be located on the same switch. This feature makes it possible for the source

port and the destination port to be located on different devices in the network, and

facilitates the network administrator to manage remote switches.

The implementation of remote port mirroring is illustrated in the following figure:

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-2

Source

Switch

Intermediate Switch

Reflector port

Source Port

Destination

Switch

Trunk port

Destination port

Remote-probe VLAN

Source

Switch

Intermediate Switch

Reflector port

Source Port

Destination

Switch

Trunk port

Destination port

Remote-probe VLAN

Figure 1-2 Remote port mirroring implementation

With the remote port mirroring function enabled, a switch plays one of the following

three roles.

z Source switch: The switch to which the monitored port belongs. The source switch

copies the mirrored traffic flows to the remote-probe VLAN, and then through

Layer 2 forwarding, the mirrored flows are sent to an intermediate switch or

destination switch.

z Intermediate switch: Switches between the source switch and destination switch

on the network. An intermediate switch forwards mirrored flows to the next

intermediate switch or the destination switch. No intermediate switch is required if

a direct connection exists between the source and destination switches.

z Destination switch: The switch to which the destination port for remote mirroring

belongs. It forwards mirrored flows it received from the remote-probe VLAN to the

monitoring device through the destination port.

 Note:

When a switch acts as an intermediate switch or destination switch for the remote

mirroring, to realize the data mirroring successfully, you are recommended to configure

redirection on the inbound interface and redirect all the packets in the remote-probe

VLAN to the corresponding outbound interface (intermediate switch) or mirroring

destination port (destination switch).

Table 1-1 describes how the ports on various switches are involved in the mirroring

operation.

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-3

Table 1-1 Ports involved in the mirroring operation

Switch Ports involved Function

Source port

Port to be mirrored; copies user data

packets to the specified reflector port

through local port mirroring. There can be

more than one source port.

Reflector port

Receives user data packets that are

mirrored on a local port.

Source switch

Trunk port

Sends mirrored packets to the intermediate

switch or the destination switch.

Intermediate

switch

Trunk port

Sends mirrored packets to the destination

switch.

Two Trunk ports are necessary for the

intermediate switch to be connected to

devices that are connected to the source

switch and the destination switch.

Trunk port

Receives remote mirrored packets.

Destination

switch

Destination port

Monitors remote mirrored packets

To implement remote port mirroring, you need to define a special VLAN, called

remote-probe VLAN, on all the three types of switches. In this VLAN, no normal data

but only mirrored packets are transmitted. All mirrored packets will be transferred to the

specified port of the destination switch from the source switch through this VLAN. Thus,

the destination switch can monitor the port packets sent from the remote ports of the

source switch. Remote-probe VLAN requires that:

z You are recommended to configure all ports connecting the devices in

remote-probe VLAN as Trunk ports.

z The default VLAN and management VLAN cannot be configured as remote-probe

VLAN.

z Required configurations are performed to ensure Layer 2 connectivity between the

source and destination switches over the remote-probe VLAN.

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-4

Caution:

To ensure the normal packet mirroring, you are not recommended to perform any of the

following operations on the remote-probe VLAN:

z Configuring a source port to the remote-probe VLAN that is used by the local

mirroring group;

z Configuring a Layer 3 interface for the remote-probe VLAN;

z Running other protocol packets, or bearing other service packets;

z Using remote-probe VLAN as a special type of VLAN, such as voice VLAN or

protocol VLAN;

z Configuring other VLAN-related functions.

1.1.3 Traffic Mirroring

Traffic mirroring maps traffic flows that match specific ACL rules to the specified local

port for packet analysis and monitoring. Before configuring traffic mirroring, you need to

define ACL rules required for flow identification.

1.1.4 Remote Traffic Mirroring

Remote traffic mirroring copies traffic flows that match specific ACLs to the reflector

port of the specified mirroring group. Then, after corresponding configurations of

remote port mirroring, the matching traffic flows are finally copied to the specified ports

of other switches. Similar to configuring local traffic mirroring, you need to define ACL

rules required for flow identification first. Otherwise, you need to complete all

configurations of remote port mirroring (except the configuration of source port for

mirroring).

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-5

1.2 Mirroring Supported by S7500

Table 1-2 Mirroring functions supported by S7500 and related commands

Function Specifications Related command

section

Support port

mirroring

mirroring-group

mirroring-group mirroring-port

mirroring-group monitor-port

Configuring

Port Mirroring

Support remote

port mirroring

mirroring-group

mirroring-group mirroring-port

mirroring-group monitor-port

mirroring-group reflector-port

mirroring-group remote-probe

vlan

remote-probe vlan enable

Configuring

Remote Port

Mirroring

Support traffic

mirroring

mirroring-group

mirroring-group mirroring-port

mirroring-group monitor-port

mirrored-to

Configuring

Traffic

Mirroring

Support remote

traffic mirroring

mirroring-group

mirroring-group monitor-port

mirroring-group reflector-port

mirroring-group remote-probe

vlan

remote-probe vlan enable

mirrored-to

Configuring

Remote

Traffic

Mirroring

1.3 Mirroring Configuration

For mirroring features, see section Overview.

1.3.1 Configuring Port Mirroring

I. Configuration prerequisites

z The source port is specified and whether the packets to be mirrored are inbound or

outbound is specified.

z The destination port is specified.

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-6

II. Configuring port mirroring in Ethernet port view

To do… Use the command… Remarks

Enter system view

system-view

—

Create a port mirroring

group

mirroring-group group-id

local

Required

Enter Ethernet port view

of the destination port

interface interface-type

interface-number

—

Define the current port as

the destination port

mirroring-group group-id

monitor-port

Required

LACP and STP must be

disabled on the

destination port

Exit current view

quit

—

Enter Ethernet port view

of the source port

interface interface-type

interface-number

—

Configure the source port

and specify the direction

of the packets to be

mirrored

mirroring-group group-id

mirroring-port { both |

inbound | outbound }

Required

Display parameter

settings of the mirroring

display mirroring-group

{ all | local }

Required

This command can be

executed in any view.

III. Configuring port mirroring in system view

To do… Use the command… Remarks

Enter system view

system-view

—

Create a port mirroring

group

mirroring-group group-id

local

Required

Configure the destination

port

mirroring-group group-id

monitor-port

Required

LACP and STP must be

disabled on the

destination port.

Configure the source port

and specify the direction

of the packets to be

mirrored

mirroring-group group-id

mirroring-port

mirroring-port-list { both |

inbound | outbound }

Required

Display parameter

settings of the mirroring

display mirroring-group

{ all | local }

Optional

This command can be

executed in any view.

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-7

IV. Configuration Example

z The source port is GigabitEthernet 2/0/1. Mirror all packets received and sent via

this port.

z The destination port is GigabitEthernet 2/0/4.

1) Configuration procedure 1:

<H3C> system-view

[H3C] mirroring-group 1 local

[H3C] interface GigabitEthernet 2/0/4

[H3C-GigabitEthernet2/0/4] mirroring-group 1 monitor-port

[H3C-GigabitEthernet2/0/4] quit

[H3C] interface GigabitEthernet 2/0/1

[H3C-GigabitEthernet2/0/1] mirroring-group 1 mirroring-port both

2) Configuration procedure 2:

<H3C> system-view

[H3C] mirroring-group 1 local

[H3C] mirroring-group 1 monitor-port GigabitEthernet 2/0/4

[H3C] mirroring-group 1 mirroring-port GigabitEthernet 2/0/1 both

1.3.2 Configuring Remote Port Mirroring

I. Configuration prerequisites

z The source switch, intermediate switch, and the destination switch have been

determined.

z The source port, the reflector port, the destination port, and the remote-probe

VLAN have been determined.

z Required configurations are performed to ensure Layer 2 connectivity between the

source and destination switches over the remote-probe VLAN.

z The direction of the packets to be monitored has been determined.

z The remote-probe VLAN is enabled.

II. Configuring remote port mirroring on the source switch

To do… Use the command… Remarks

Enter system view

system-view

—

Create a VLAN and enter

its VLAN view

vlan vlan-id

vlan-id is the ID of the

destination remote-probe

VLAN.

Define the current VLAN

as a remote-probe VLAN

remote-probe vlan

enable

Required

Exit current view

quit

—

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-8

To do… Use the command… Remarks

Enter port view of ports

that connected to the

intermediate switch or

destination switch

interface interface-type

interface-number

—

Configure the current port

as a trunk port

port link-type trunk

Required

By default, the type of the

port is access.

Configure Trunk port to

permit packets from the

remote-probe VLAN

port trunk permit vlan

remote-probe-vlan-id

Required

This setting is required for

source switch ports that

connected with the

intermediate switch or

destination switch.

Exit current view

quit

—

Configure a remote

source mirroring group

mirroring-group group-id

remote-source

Required

Configure a source port

for remote mirroring

mirroring-group group-id

mirroring-port

mirroring-port-list { both |

inbound | outbound }

Required

Configure a remote

reflector port

mirroring-group group-id

reflector-port

Required

The remote reflector port

must be of the Access

type. LACP and STP must

be disabled on this port.

After a port is configured

as a reflector port, the

switch does not allow you

to perform any of the

following configurations:

z Changing the port type

and its default VLAN

z Add it to another VLAN

Configure the

remote-probe VLAN for

the remote source

mirroring group

mirroring-group group-id

remote-probe vlan

remote-probe-vlan-id

Required

Display the configuration

of the remote source

mirroring group

display mirroring-group

remote-source

Optional

This command can be

executed in any view.

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-9

 Note:

z To mirror tagged packets, you need to configure VLAN VPN on the reflector port.

z The reflector port cannot forward traffics as a normal port. Therefore, it is

recommended that you use a idle and in-down-state port as the reflector port, and

be careful to not add other settings on this port.

z Be sure not to configure a port used to connect the intermediate and destination

switches as the mirroring source port. Otherwise traffic disorder may occur in the

network.

III. Configuring remote port mirroring on the intermediate switch

To do… Use the command… Remarks

Enter system view

system-view

—

Create a remote-probe VLAN

and enter VLAN view

vlan vlan-id

vlan-id is the ID of the

remote-probe VLAN.

Define the current VLAN as a

remote-probe VLAN

remote-probe vlan

enable

Required

Exit current view

quit

—

Enter Ethernet port view of the

port through which the

intermediate switch is

connected to the source

switch, destination switch or

another intermediate switch

interface

interface-type

interface-number

—

Configure the current port as a

trunk port

port link-type trunk

Required

By default, the type of the

port is access.

Configure Trunk port to permit

packets from the

remote-probe VLAN

port trunk permit

vlan

remote-probe-vlan-id

Required

This configuration is

necessary for ports on the

intermediate switch that

are connected to the

source switch or the

destination switch.

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-10

 Note:

When a switch acts as a remote port mirroring intermediate switch, to realize the data

mirroring successfully, you are recommended to configure redirection on the inbound

interface and redirect all the packets in the remote-probe VLAN to the corresponding

outbound interface.

IV. Configuring remote port mirroring on the destination switch

To do… Use the command… Remarks

Enter system view

system-view

—

Create a remote-probe

VLAN and enter VLAN

view

vlan vlan-id

vlan-id is the ID of the

remote-probe VLAN.

Define the current VLAN

as a remote-probe VLAN

remote-probe vlan

enable

Required

Exit the current view

quit

—

Enter Ethernet port view

of the port through which

the destination switch is

connected to the source

switch or an intermediate

switch

interface interface-type

interface-number

—

Configure the current port

as a trunk port

port link-type trunk

Required

By default, the type of the

port is access.

Configure Trunk port to

permit packets from the

remote-probe VLAN

port trunk permit vlan

remote-probe-vlan-id

Required

This configuration is

necessary for ports

through which the

destination switch is

connected to the source

switch or an intermediate

switch.

Exit current view

quit

—

Configure the remote

destination mirroring

group

mirroring-group group-id

remote-destination

Required

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-11

To do… Use the command… Remarks

Configure the destination

port for remote mirroring

mirroring-group group-id

monitor-port

Required

The destination port for

remote mirroring must be

of the Access type. LACP

and STP must be disabled

on this port.

After you configure a port

as the destination port for

remote mirroring, the

switch does not allow you

to change the port type or

default VLAN ID of the

port.

Configure the

remote-probe VLAN for

the remote destination

mirroring group

mirroring-group group-id

remote-probe vlan

remote-probe-vlan-id

Required

Display the configuration

of the remote destination

mirroring group

display mirroring-group

remote-destination

Optional

This command can be

executed in any view.

 Note:

When a switch acts as a remote port mirroring destination switch, to realize the data

mirroring successfully, you are recommended to configure redirection on the inbound

interface and redirect all the packets in the remote-probe VLAN to the corresponding

mirroring destination port.

V. Configuration example

1) Network requirements:

z Switch A is connected to the data detect device via GigabitEthernet 2/0/2.

z GigabitEthernet 2/0/1, the Trunk port of Switch A, is connected to GigabitEthernet

2/0/1, the Trunk port of Switch B.

z GigabitEthernet 2/0/2, the Trunk port of Switch B, is connected to GigabitEthernet

2/0/1, the Trunk port of Switch C.

z GigabitEthernet 2/0/2, the port of Switch C, is connected to PC 1.

The purpose is to monitor and analyze the packets sent to PC 1 via the data detect

device.

To meet the requirement above by using the remote port mirroring function, perform the

following configuration:

z Define VLAN 10 as remote-probe VLAN.

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-12

z Define Switch A as the destination switch; configure GigabitEthernet 2/0/2, the

port that is connected to the data detect device, as the destination port for remote

mirroring. Set GigabitEthernet 2/0/2 to an Access port, with STP and LACP

functions disabled.

z Define Switch B as the intermediate switch.

z Define Switch C as the source switch, GigabitEthernet 2/0/2 as the source port for

remote mirroring, and GigabitEthernet 2/0/3 as the reflector port. Set

GigabitEthernet 2/0/3 to an Access port, with STP and LACP disabled.

2) Network diagram

Switch C

GE2/0/1

PC1

Switch B

GE2/ 0/ 2 GE2 /0 / 1

GE2/0/2

Switch A

2/0/1

GE2/0/2

Data detect device

Figure 1-3 Network diagram for remote port mirroring configuratio

3) Configuration procedure

# Configure Switch C.

<H3C> system-view

[H3C] vlan 10

[H3C-vlan10] remote-probe vlan enable

[H3C-vlan10] quit

[H3C] interface GigabitEthernet 2/0/1

[H3C-GigabitEthernet2/0/1] port link-type trunk

[H3C-GigabitEthernet2/0/1] port trunk permit vlan 10

[H3C-GigabitEthernet2/0/1] quit

[H3C] mirroring-group 1 remote-source

[H3C] mirroring-group 1 mirroring-port GigabitEthernet 2/0/2 inbound

[H3C] mirroring-group 1 reflector-port GigabitEthernet 2/0/3

[H3C] mirroring-group 1 remote-probe vlan 10

[H3C] display mirroring-group remote-source

mirroring-group 1:

type: remote-source

status: active

mirroring port:

GigabitEthernet2/0/2 inbound

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-13

reflector port: GigabitEthernet2/0/3

remote-probe vlan: 10

# Configure Switch B.

<H3C> system-view

[H3C] vlan 10

[H3C-vlan10] remote-probe vlan enable

[H3C-vlan10] quit

[H3C] interface GigabitEthernet 2/0/1

[H3C-GigabitEthernet2/0/1] port link-type trunk

[H3C-GigabitEthernet2/0/1] port trunk permit vlan 10

[H3C-GigabitEthernet2/0/1] quit

[H3C] interface GigabitEthernet 2/0/2

[H3C-GigabitEthernet2/0/2] port link-type trunk

[H3C-GigabitEthernet2/0/2] port trunk permit vlan 10

# Configure Switch A.

<H3C> system-view

[H3C] vlan 10

[H3C-vlan10] remote-probe vlan enable

[H3C-vlan10] quit

[H3C] interface GigabitEthernet 2/0/1

[H3C-GigabitEthernet2/0/1] port link-type trunk

[H3C-GigabitEthernet2/0/1] port trunk permit vlan 10

[H3C-GigabitEthernet2/0/1] quit

[H3C] mirroring-group 1 remote-destination

[H3C] mirroring-group 1 monitor-port GigabitEthernet 2/0/2

[H3C] mirroring-group 1 remote-probe vlan 10

[H3C] display mirroring-group remote-destination

mirroring-group 1:

type: remote-destination

status: active

monitor port: GigabitEthernet2/0/2

remote-probe vlan: 10

1.3.3 Configuring Traffic Mirroring

I. Configuration prerequisites

z ACLs for identifying traffics have been defined. For defining ACLs, see the

description on the ACL module in this manual.

z The destination port has been defined.

z The port on which to perform traffic mirroring configuration and the direction of

traffic mirroring has been determined.

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-14

II. Configuration procedure

To do… Use the command… Remarks

Enter system view

system-view

—

Create a mirroring group

mirroring-group group-id

local

Required

Define the destination port

mirroring-group group-id

monitor-port

Required

LACP and STP cannot be

enabled on the

destination port.

Enter Ethernet port view

of the source port

interface interface-type

interface-number

—

Enter QoS view

qos

—

Reference ACLs for

identifying traffic flows

and perform traffic

mirroring for packets that

match.

mirrored-to inbound

acl-rule [ system-index ]

{ interface interface-type

interface-number |

mirroring-group

group-id }

Required

Display the parameter

settings of traffic mirroring

display qos-interface

[ interface-type

interface-number ]

mirrored-to

Display all QoS settings of

a port

display qos-interface

[ interface-type

interface-number ] all

Optional

These commands can be

executed in any view.

acl-rule: Applied ACL rules, which can be the combination of different types of ACL

rules. The following table describes the ACL combinations.

Table 1-3 Combined application of ACLs on type A LPUs.

Combination mode Form of acl-rule

Apply all rules in an IP type ACL ip-group { acl-number | acl-name }

Apply one rule in an IP type ACL

ip-group { acl-number | acl-name } rule

rule-id

Apply all rules in a link type ACL link-group { acl-number | acl-name }

Apply one rule in a link type

link-group { acl-number | acl-name } rule

rule-id

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-15

Table 1-4 Combined application of ACLs on LPUs other than type A.

Combination mode Form of acl-rule

Apply all rules in an IP type ACL ip-group { acl-number | acl-name }

Apply one rule in an IP type ACL

ip-group { acl-number | acl-name } rule

rule-id

Apply all rules in a link type ACL link-group { acl-number | acl-name }

Apply one rule in a link type

link-group { acl-number | acl-name }

rule rule-id

Apply all rules in a user-defined ACL user-group { acl-number | acl-name }

Apply one rule in a user-defined ACL

user-group { acl-number | acl-name }

rule rule-id

Apply one rule in an IP type ACL and one

rule in a Link type ACL simultaneously

ip-group { acl-number | acl-name } rule

rule-id link-group { acl-number |

acl-name } rule rule-id

 Note:

To define a destination port for mirroring, you can also enter the port view of the

specified port directly to execute the mirroring-group group-id monitor-port

command. Refer to corresponding command manual for detail.

III. Configuration example

1) Network requirements:

z GigabitEthernet 2/0/1 on the switch is connected to the 10.1.1.1/24 network

segment.

z Mirror the packets from the 10.1.1.1/24 network segment to GigabitEthernet 2/0/4,

the destination port.

2) Configuration procedure:

<H3C> system-view

[H3C] acl number 2000

[H3C-acl-basic-2000] rule permit source 10.1.1.1 0.0.0.255

[H3C-acl-basic-2000] rule deny source any

[H3C-acl-basic-2000] quit

[H3C] mirroring-group 3 local

[H3C] mirroring-group 3 monitor-port GigabitEthernet 2/0/4

[H3C] interface GigabitEthernet 2/0/1

[H3C-GigabitEthernet2/0/1] qos

[H3C-qosb-GigabitEthernet2/0/1] mirrored-to inbound ip-group 2000 interface

GigabitEthernet 2/0/4

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-16

1.3.4 Configuring Remote Traffic Mirroring

I. Configuration prerequisites

z ACLs for identifying traffics have been defined. For defining ACLs, refer to the

description on the ACL module in this manual.

z The source switch, intermediate switch and the destination switch have been

specified.

z The reflector port, destination port for mirroring, and remote-probe VLAN have

been specified.

z Required configurations are performed to ensure Layer 2 connectivity between the

source and destination switches over the remote-probe VLAN.

z The direction of traffic packets to be monitored has been determined.

z The remote-probe VLAN has been enabled.

II. Configuring the source switch

To do… Use the command… Remarks

Enter system view

system-view

—

Create a VLAN and enter

the VLAN view

vlan vlan-id

The vlan-id is the ID of the

remote-probe VLAN to be

defined.

Define the current VLAN

as the remote-probe

VLAN

remote-probe vlan

enable

Required

Quit from the current view

quit

—

Enter port view of the port

connected with an

intermediate switch or a

destination switch

interface interface-type

interface-number

—

Configure the current port

as a trunk port

port link-type trunk

Required

By default, the type of the

port is access.

Configure the trunk port

to permit the packets

from the remote-probe

VLAN to pass by.

port trunk permit vlan

remote-probe-vlan-id

Required

This configuration is

required on the source

switch ports that connect

with the intermediate

switch and the destination

switch must be configured

so.

Quit from the current view

quit

—

Configure the remote

source mirroring group

mirroring-group

group-id remote-source

Required

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-17

To do… Use the command… Remarks

Configure the remote

reflector port

mirroring-group

group-id reflector-port

reflector-port

Required

The remote reflector port

must be Access port and

LACP and STP must be

disabled on the remote

reflector port.

After a port is configured as

reflector port, you can

neither change the port

type and the default VLAN

ID nor add the reflector port

to other VLANs.

Configure the

remote-probe VLAN of

the remote source

mirroring group

mirroring-group

group-id remote-probe

vlan

remote-probe-vlan-id

Required

Ether Ethernet port view

of the source port

interface interface-type

interface-number

—

Enter QoS view

qos

—

Reference ACLs for

identifying traffic flows

and perform traffic

mirroring for packets that

match.

mirrored-to inbound

acl-rule [ system-index ]

{ interface interface-type

interface-number

reflector |

mirroring-group

group-id }

Required

Display configuration of

the remote source

mirroring group

display mirroring-group

remote-source

Display the parameter

settings of traffic

mirroring

display qos-interface

[ interface-type

interface-number ]

mirrored-to

Display all QoS settings

of a port

display qos-interface

[ interface-type

interface-number ] all

Optional

You can execute the

display command in any

view.

acl-rule: Applied ACL rules, which can be the combination of different types of ACL

rules. For the ACL combinations of the type A LPUs, refer to

Table 1-3, and for the ACL

combinations of LPUs other than type A, refer to

Table 1-4.

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-18

 Note:

z If you want to mirror the tagged packets, you need to configure VLAN VPN on the

reflector port.

z For the reflector port can not forward traffic as a normal port does, you are

recommended to configure the port that is not in use to be the reflector port and not

to perform other configurations on this port.

III. Configuring the intermediate switch

The configuration of remote traffic mirroring on the intermediate switch is the same as

that of remote port mirroring on the intermediate switch. Refer to

Configuring remote

port mirroring on the intermediate switch

IV. Configuring the destination switch

The configuration of remote traffic mirroring on the destination switch is the same as

that of remote port mirroring on the destination switch. Refer to

Configuring remote port

mirroring on the destination switch

V. Configuration example

1) Network requirements:

z Switch A is connected to the data detect device through GigabitEthernet 2/0/2.

z GigabitEthernet 2/0/1, the Trunk port of Switch A, is connected to GigabitEthernet

2/0/1, the Trunk port of Switch B.

z GigabitEthernet 2/0/2, the Trunk port of Switch B, is connected to GigabitEthernet

2/0/1, the Trunk port of Switch C.

z GigabitEthernet 2/0/2, the port of Switch C, is connected to the 10.1.1.1/24

network segment.

Use the remote traffic mirroring function to mirror the packets from the 10.1.1.1/24

network segment to GigabitEthernet 2/0/2, the port of Switch A, so that the data detect

device can monitor the traffic:

z Define VLAN10 as remote-probe VLAN.

z Define Switch A as the destination switch; configure GigabitEthernet 2/0/2, the

port that is connected to the data detect device, as the destination port for remote

mirroring. Set GigabitEthernet 2/0/2 to an Access port, with STP and LACP

functions disabled.

z Define Switch B as the intermediate switch.

z Define Switch C as the source switch, GigabitEthernet 2/0/3 as the reflector port.

Set GigabitEthernet 2/0/3 to an Access port, with STP and LACP disabled.

Configure the traffic mirroring function on GigabitEthernet 2/0/2.

2) Network diagram

Operation Manual – Mirroring

H3C S7500 Series Ethernet Switches Chapter 1

Mirroring Configuration

1-19

Switch C

GE2/0/1

Switch B

GE2/0/2 GE2/0/1

GE2/0/2

Switch A

2/0/1

GE2/0/2

Data detect device

10.1.1.1/24

Figure 1-4 Network diagram for remote traffic mirroring

3) Configuration procedure

# Configure Switch A.

<H3C> system-view

[H3C] vlan 10

[H3C-vlan10] remote-probe vlan enable

[H3C-vlan10] quit

[H3C] interface GigabitEthernet 2/0/1

[H3C-GigabitEthernet2/0/1] port link-type trunk

[H3C-GigabitEthernet2/0/1] port trunk permit vlan 10

[H3C-GigabitEthernet2/0/1] quit

[H3C] mirroring-group 1 remote-destination

[H3C] mirroring-group 1 monitor-port GigabitEthernet 2/0/2

[H3C] mirroring-group 1 remote-probe vlan 10

[H3C] display mirroring-group remote-destination

mirroring-group 1:

type: remote-destination

status: active

monitor port: GigabitEthernet2/0/2

remote-probe vlan: 10

# Configure Switch B

<H3C> system-view

[H3C] vlan 10

[H3C-vlan10] remote-probe vlan enable

[H3C-vlan10] quit

[H3C] interface GigabitEthernet 2/0/1

[H3C-GigabitEthernet2/0/1] port link-type trunk

[H3C-GigabitEthernet2/0/1] port trunk permit vlan 10

[H3C-GigabitEthernet2/0/1] quit

[H3C] interface GigabitEthernet 2/0/2

Page is loading ...

H3C S7500 Series Operating instructions

H3C S7500 Series Operating instructions

H3C S7500 Series Operating instructions

Related papers

Other documents