BigIron RX Series Configuration Guide 14353-1001810-01Mirror ports for Policy-Based Routing (PBR) traffic 6Mirror ports for Policy-Based Routing (PBR) trafficYou can mirror traffic on ports that have policy-based routing (PBR) enabled. This feature is usefulfor monitoring traffic, debugging, and enabling application-specific mirroring.The PBR mirror interface feature allows continued hardware forwarding and, at the same time,enables you to determine exactly which traffic flows get routed using the policies defined by PBR.The following section provides a general overview of hardware-based PBR.About hardware-based PBRHardware-based Policy-Based Routing (PBR) routes traffic in hardware based on policies youdefine. A PBR policy specifies the next hop for traffic that matches the policy. A PBR policy alsocan use an ACL to perform QoS mapping and marking for traffic that matches the policy.To configure PBR, you define the policies using IP ACLs and route maps, then enable PBR globallyor on individual interfaces. The device programs the ACLs into the Layer 4 CAM on the interfacesand routes traffic that matches the ACLs according to the instructions in the route maps. You alsocan map and mark the traffic's QoS information using the QoS options of the ACLs.Configuring mirror ports for PBR trafficWhen you configure a physical or virtual port to act as a mirror port for PBR traffic, outgoingpackets that match the permit Access Control List (ACL) clause in the route map are copied to themirror ports that you specify. You can specify up to four mirror ports for each PBR route mapinstance.For example, to capture all traffic forwarded to an SSL port and mirror it to port 5, enter commandssuch as the following.BigIron RX(config)# route-map ssl-pbr-map permit 1BigIron RX(config-routemap ssl-pbr-map)# match ip address 100BigIron RX(config-routemap ssl-pbr-map)# set mirror-interface 5BigIron RX(config-routemap ssl-pbr-map)# set next-hop 10.10.10.1BigIron RX(config-routemap ssl-pbr-map)# exitBigIron RX(config)# interface e 5BigIron RX(config-if-e10000-5)# port-name mirror-portBigIron RX(config-if-mirror-port)# interface e 10BigIron RX(config-if-mirror-port-10)# ip policy route-map ssl-pbr-mapBigIron RX(config-if-mirror-port-10)# exitBigIron RX(config-if-e10000-)#exitBigIron RX(config)#access-list 100 permit tcp any any eq sslThe above commands complete the following configuration tasks.1. Configures an entry in the PBR route map named “ssl-pbr-map” . The match statementmatches on IP information in ACL 100. The set mirror-interface statement specifies interface e5 as the mirror port for matched ACL permit clauses. The set next-hop statement sets the IPaddress of the route’s next hop router to 10.10.10.1.2. Identifies interface e 5 as a mirror port by assigning the name “mirror-port”.3. Enables PBR and applies the route map “ssl-pbr-map” on interface e 10.4. Creates an extended ACL (100) that permits all TCP traffic destined for an for an SSL port.
