S3526镜像 (新命令).doc

S3526版本Version 3.10, RELEASE 0015 （新命令）第一种情况：被镜像的数据在同一个vlan里配置：acl number 1 rule 1 permit source 1.1.1.1 0 rule 0 permit source 1.1.1.2 0#acl number 100 rule 0 permit icmp source 1.1.1.1 0 destination 1.1.1.2 0 rule 1 permit icmp source 1.1.1.2 0 destination 1.1.1.1 0#acl number 200 rule 0 permit ingress interface Ethernet0/1 egress any rule 1 permit ingress any egress interface Ethernet0/1#mirrored-to link-group 200 rule 0 interface Ethernet0/24 /分别执行不同的acl情况如下：在1.1.1.2 上ping 1.1.1.11. 执行 mirrored-to link-group 200 rule 0 interface Ethernet0/24 镜像结果source address Dest address summary1.1.1.1 1.1.1.2 ICMP：Echo reply1.1.1.1 1.1.1.2 ICMP：Echo reply1.1.1.1 1.1.1.2 ICMP：Echo reply2执行 mirrored-to link-group 200 rule 1 interface Ethernet0/24 镜像结果source address Dest address summary1.1.1.2 1.1.1.1 ICMP：Echo1.1.1.2 1.1.1.1 ICMP：Echo1.1.1.2 1.1.1.1 ICMP：Echo3执行 mirrored-to link-group 200 rule 0 interface Ethernet0/24 mirrored-to link-group 200 rule 1 interface Ethernet0/24镜像结果source address Dest address summary1.1.1.2 1.1.1.1 ICMP：Echo1.1.1.1 1.1.1.2 ICMP：Echo reply1.1.1.2 1.1.1.1 ICMP：Echo1.1.1.1 1.1.1.2 ICMP：Echo reply4执行 acl 1 和 acl 100 镜像不起作用，都抓不到包提示：镜像端口24和被镜像端口1，可以在同一个vlan也可以不同vlan。第二种情况：被镜像的数据在不同的vlan里配置acl number 1 rule 1 permit source 1.1.1.1 0 rule 2 permit source 1.1.1.0 0.0.0.255acl number 2 rule 0 permit source 2.2.2.2 0 rule 1 permit source 2.2.2.0 0.0.0.255acl number 100 rule 0 permit icmp source 1.1.1.1 0 destination 2.2.2.2 0 rule 1 permit icmp source 1.1.1.0 0.0.0.255 destination 2.2.2.0 0.0.0.255acl number 101rule 0 permit icmp rule 1 permit icmp source 2.2.2.2 0 rule 2 permit icmp destination 1.1.1.1 0 rule 3 permit icmp destination 1.1.1.0 0.0.0.255acl number 200 rule 0 permit ingress interface Ethernet0/1 egress any rule 1 permit ingress any egress interface Ethernet0/1vlan 1vlan 2interface Vlan-interface1 ip address 1.1.1.3 255.255.255.0interface Vlan-interface2 ip address 2.2.2.3 255.255.255.0mirrored-to ip-group 1 rule 1 interface Ethernet0/24 /分别执行不同的acl情况如下：从2.2.2.2 上ping 1.1.1.1 1分别单独执行mirrored-to ip-group 1 rule1 interface Ethernet0/24mirrored-to ip-group 1 rule 2 interface Ethernet0/24 镜像结果一样source address Dest address summary1.1.1.1 2.2.2.2 ICMP：Echo reply1.1.1.1 2.2.2.2 ICMP：Echo reply1.1.1.1 2.2.2.2 ICMP：Echo reply2执行mirrored-to ip-group 2 rule 0 interface Ethernet0/24 mirrored-to ip-group 2 rule 1 interface Ethernet0/24 镜像结果source address Dest address summary2.2.2.2 1.1.1.1 ICMP：Echo2.2.2.2 1.1.1.1 ICMP：Echo2.2.2.2 1.1.1.1 ICMP：Echo3分别单独执行mirrored-to ip-group 100 rule 0 interface Ethernet0/24mirrored-to ip-group 100 rule 1 interface Ethernet0/24 镜像结果一样source address Dest address summary2.2.2.2 1.1.1.1 ICMP：Echo1.1.1.1 2.2.2.2 ICMP：Echo reply2.2.2.2 1.1.1.1 ICMP：Echo1.1.1.1 2.2.2.2 ICMP：Echo reply4执行mirrored-to ip-group 101 interface Ethernet0/24 （配置了有any的acl）显示： Applying Acl 101 rule 0 failed!Applying Acl 101 rule 1 failed! Reason: Not support! Applying Acl 101 rule 2 failed! Reason: Not support! Applying Acl 101 rule 3 failed! Reason: Not support! 5执行mirrored-to link-group 200 rule 0 interface Ethernet0/24 mirrored-to link-group 200 rule 1 interface Ethernet0/24镜像不成功，都抓不到包提示：1 可以通过源地址，抓单项的数据包。2 对于扩展的acl 当启用一条rule 会在两个方向上生效。情况和在老命令里的一样这里就不再赘述了。3S3526在三层acl 1199 里不支持any 4如果数据包是ping 本地 vlan接口地址 （在1.1.1.1上ping 1.1.1.3）acl number 111 rule 0 permit icmp source 1.1.1.1 0 destination 1.1.1.3 0在启用的时候会提示： Quidwaymirr ip 111 int e0/24 Applying Acl 111 rule 0 failed!试验结论：1在镜像同一个vlan里的数据时只能用acl