Example for Configuring Local Port Mirroring to Monitor User Behaviors
Huawei router configuration:
This example applies to all of huawei AR router V200R002C00 and later versions.
Networking Requirements
As shown in Figure 1, the router functions as the egress gateway of an enterprise. The R&D department and marketing department of the enterprise connect to Ethernet2/0/0 and Ethernet2/0/1 on the router. The server (a data monitoring device) that has the monitoring software installed connects to Ethernet2/0/2 on the router to analyze the captured packets. To ensure enterprise information security, configure local port mirroring on the router to help the server monitor all the packets sent by the R&D department and marketing department.
Figure 1 Local port mirroring networking
Procedure
Configure the router AR1200, I use it on the network.
#
observe-port interface Ethernet2/0/2 //Configure the local observing port.
#
interface Ethernet2/0/0
mirror to observe-port inbound //Configure Ethernet2/0/0 as the local mirrored port, and mirror only incoming packets on a port.
#
interface Ethernet2/0/1
mirror to observe-port inbound //Configure Ethernet2/0/1 as the local mirrored port, and mirror only incoming packets on a port.
#
Verify the configuration.
Run the display observe-port command on the router to view the observing port configuration. In the command output, the Interface field displays Ethernet2/0/2.
Run the display mirror-port command on the router to view the mirrored port configuration. In the command output, the Mirror-port field displays Ethernet2/0/0 and Ethernet2/0/1.
Run the display interface command on the router to view packet statistics on Ethernet2/0/0, Ethernet2/0/1, and Ethernet2/0/2. The command output shows that the number of outgoing packets on Ethernet2/0/2 equals the total number of incoming packets on Ethernet2/0/0 and Ethernet2/0/1. You can also view all the packets received by Ethernet2/0/0 and Ethernet2/0/1 on the server, indicating that packets on Ethernet2/0/0 and Ethernet2/0/1 have been mirrored by the router.
Configuration Notes
A router can have only one observing port, which must be a LAN-side Ethernet port.
On the router, the packets on multiple ports can be mirrored to one observing port.
When you configure the observing port and mirrored port, correctly allocate bandwidth to the ports. If a GE interface is used as the mirrored port and an Ethernet interface is used as the observing port, the observing port bandwidth is insufficient. This may result in the loss of mirrored packets.
After an interface is configured as the observing port, do not perform other configurations on the interface. Otherwise, the local port mirroring function may be affected. For example, if the observing port transmits both mirrored packets and other service traffic, the observing port cannot identify the source of the packets. When the observing port becomes congested, mirrored packets may be discarded because these packets have lower priority than service traffic.
More related:
Example for Configuring the SNMP Function to Implement Communication Between the Device and the NMS
Example for Connecting Intranet Users to the Internet in Easy IP Mode
Example for Configuring the Device as a PPPoE Client to Connect Users to the Internet
How to Configure the PPPoE Client on Huawei AR1200?
Example for Connecting Intranet Users to the Internet in NAT Address Pool Mode











