Port Monitoring | 821Figure 38-8. Configuring Flow-based MonitoringRemote Port MirroringRemote Port Mirroring is supported on platforms: ex.While local port monitoring allows you to monitor traffic from one or more source ports by directing it to adestination port on the same switch/router, remote port mirroring allows you to monitor Layer 2 andLayer 3 ingress traffic on multiple source ports on different switches and forward the mirrored traffic tomultiple destination ports on different switches. Remote port mirroring helps network administratorsmonitor and analyze traffic to troubleshoot network problems in a time-saving and efficient way.In a remote-port mirroring session, monitored traffic is tagged with a VLAN ID and switched on auser-defined, non-routable L2 VLAN. The VLAN is reserved in the network to carry only mirrored traffic,which is forwarded on all egress ports of the VLAN. Each intermediate switch that participates in thetransport of mirrored traffic must be configured with the reserved L2 VLAN. Remote port mirroringsupports mirroring sessions in which multiple source and destination ports are distributed across multipleswitches.Remote Port Mirroring ExampleFigure 38-9 shows an example of how remote port mirroring works.FTOS(conf)#monitor session 0FTOS(conf-mon-sess-0)#flow-based enableFTOS(conf)#ip access-list ext testflowFTOS(config-ext-nacl)#seq 5 permit icmp any any count bytes monitorFTOS(config-ext-nacl)#seq 10 permit ip 102.1.1.0/24 any count bytes monitorFTOS(config-ext-nacl)#seq 15 deny udp any any count bytesFTOS(config-ext-nacl)#seq 20 deny tcp any any count bytesFTOS(config-ext-nacl)#exitFTOS(conf)#interface gig 1/1FTOS(conf-if-gi-1/1)#ip access-group testflow inFTOS(conf-if-gi-1/1)#show config!interface GigabitEthernet 1/1ip address 10.11.1.254/24ip access-group testflow inshutdownFTOS(conf-if-gi-1/1)#exitFTOS (conf)#do show ip accounting access-list testflow!Extended Ingress IP access list testflow on GigabitEthernet 1/1Total cam count 4seq 5 permit icmp any any monitor count bytes (0 packets 0 bytes)seq 10 permit ip 102.1.1.0/24 any monitor count bytes (0 packets 0 bytes)seq 15 deny udp any any count bytes (0 packets 0 bytes)seq 20 deny tcp any any count bytes (0 packets 0 bytes)FTOS(conf)#do show monitor session 0SessionID Source Destination Direction Mode Type--------- ------ ----------- --------- ---- ----0 Gi 1/1 Gi 1/2 rx interface Flow-based
