Port mirroring is a quite common task and not easily done on consumer equipment, but using a Juniper SRX it easy REALLY easy. Let’s have a look:
Assume
– you want to mirror all the HTTP traffic on your LAN.
– you want to send it to a device with IP 192.168.1.21 which is directly connected to the Juniper.
Step 1
Move the port (lets say fe-0/0/1) where your mirror equipment will connect to the Juniper from switching to routing and give an IP (within the subnet of the sniffing device):
fe-0/0/1 {
unit 0 {
family inet {
address 192.168.1.1/24;
}
}
}Step 2
Inside the interface configuration for the network you want to monitor (here just vlan.0 and my current IP for it is .2.1), set a filter (we will explain what it is in step 4):
vlan {
unit 0 {
family inet {
filter {
input port-mirror;
output port-mirror;
}
address 192.168.2.1/24;
}
}
}Step 3
Enable port-mirroring in the forwarding options, telling them the next hop (=your sniffing device):
port-mirroring {
input {
rate 1;
run-length 10;
}
family inet {
output {
interface fe-0/0/1.0 {
next-hop 192.168.1.21;
}
}
}
}Step 4
Define what the filter “port-mirror” should do. As we want to mirror only HTTP traffic, we will create 3 terms:
– Term 1 will mirror all traffic coming from port 80 TCP
– Term 2 will mirror all traffic going to port 80 TCP
– Term 3 will accept all other traffic (=not mirroring it). This is tricky/important! If you install a filter which mirrors the traffic but contains no implicit ALLOW at the end, it will block all the traffic!
filter port-mirror {
term 1 {
from {
source-port http;
}
then {
port-mirror;
accept;
}
}
term 2 {
from {
destination-port http;
}
then {
port-mirror;
accept;
}
}
term 3 {
from {
source-address {
0.0.0.0/0;
}
}
then accept;
}
}This is the Juniper KB if you feel my explanation isn’t good enough ;)
https://kb.juniper.net/InfoCenter/index?page=content&id=KB21833&smlogin=true