(2) 在远程镜像 VLAN 中添加监控端口 # 将端口 Ethernet1/3 加入远程镜像 VLAN。
[Device] interface ethernet 1/3 [Device-Ethernet1/3] port access vlan 2 [Device-Ethernet1/3] quit
端口镜像配置举例
Copyright © 2013 杭州华三通信技术有限公司 版权所有，保留一切权利。 非经本公司书面许可，任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部， 并不得以任何形式传播。本文档中的信息可能变动，恕不另行通知。
目录
1 简介 ······················································································································································ 1 2 配置前提 ··············································································································································· 1 3 多个目的端口配置举例·························································································································· 1
[Device] mirroring-group 1 remote-probe vlan 2 [Device] mirroring-group 1 mirroring-port ethernet 1/1 inbound [Device] mirroring-group 1 reflector-port ethernet 1/2
3.1 组网需求 ··············································································································································· 1 3.2 配置思路 ··············································································································································· 2 3.3 配置步骤 ··············································································································································· 2 3.4 验证配置 ··············································································································································· 2 3.5 配置文件 ··············································································································································· 2 4 多台源设备镜像配置举例 ······················································································································ 3 4.1 组网需求 ··············································································································································· 3 4.2 配置思路 ··············································································································································· 3 4.3 配置步骤 ··············································································································································· 4
3.5 配置文件
# mirroring-group 1 remote-source mirroring-group 1 remote-probe vlan 2
# vlan 1 # vlan 2 # interface Ethernet1/1
port link-mode bridge 2
mirroring-group 1 mirroring-port inbound # interface Ethernet1/2
1
3.2 配置思路
本例中的一个源端口和两个目的端口都位于同一台设备上，所以应优先考虑采用本地端口镜像方 式。但一个本地镜像组内不允许有两个目的端口，所以需配置两个本地镜像组，而一个源端口又 不能同时属于两个本地镜像组，所以此方式无法实现本例的需求。 在这种情况下，可借助二层远程端口镜像的反射端口方式实现需求：利用反射端口会在远程镜像 VLAN 中广播镜像报文的原理，将两个目的端口都加入远程镜像 VLAN 即可。
port link-mode bridge mirroring-group 1 reflector-port # interface Ethernet1/3 port link-mode bridge port access vlan 2 # interface Ethernet1/4 port link-mode bridge port access vlan 2 #
4.3.1 Device A的配置 ························································································································· 4 4.3.2 Device B的配置 ························································································································· 4 4.3.3 Device C的配置 ························································································································· 5 4.4 验证配置 ··············································································································································· 5 4.5 配置文件 ··············································································································································· 6
# 创建 VLAN 2。
[DeviceA] vlan 2 [DeviceA-vlan2] quit
# 为远程源镜像组配置远程镜像 VLAN、源端口和反射口。
3 多个目的端口配置举例
3.1 组网需求
如 图 1 所示，用户有两台监控分析设备，一台是分析仪，另一台是IDS（Intrusion Detection System，入侵检测系统）设备。用户希望能对来自互联网的流量同时进行分析和入侵检测。本组 网中的Device设备不支持一个端口被多个本地镜像组用作源端口。 图1 多个目的端口配置组网图
3ห้องสมุดไป่ตู้
Device C 上，不能通过配置远程镜像组将不同远程镜像 VLAN 的流量送至分析器，而要通过配置 连接分析仪的端口允许不同远程镜像 VLAN 通过来达到该目的。
4.3 配置步骤
4.3.1 Device A的配置
(1) 配置远程源镜像组 # 创建远程源镜像组 1。
<DeviceA> system-view [DeviceA] mirroring-group 1 remote-source
# 将端口 Ethernet1/4 加入远程镜像 VLAN。
[Device] interface ethernet 1/4 [Device-Ethernet1/4] port access vlan 2
3.4 验证配置
用户在两台监控分析设备上可以同时收到来自互联网的流量，镜像功能生效。这样，用户就可以 对互联网的流量分别进行综合分析和入侵检测了。
3.3 配置步骤