Juniper JUNOS OS 10.3 - SOFTWARE, Manual

Page: 3643 / 3946

user@switch#
set filter watch-employee term employee-to-corp from
destination-address 192.0.2.16/28
user@switch# set filter watch-employee term employee-to-corp from source-address
192.0.2.16/28
user@switch# set filter watch-employee term employee-to-corp then accept
user@switch#
set filter watch-employee term employee-to-web from destination-port
80
user@switch# set filter watch-employee term employee-to-web then analyzer
employee-web-monitor
4.
Apply the watch-employee filter to the appropriate ports:
[edit interfaces]
user@switch#
set ge-0/0/0 unit 0 family ethernet-switching filter input
watch-employee
user@switch# set ge-0/0/1 unit 0 family ethernet-switching filter input
watch-employee
Results Check the results of the configuration:
[edit]
user@switch# show
ethernet-switching-options {
analyzer employee-web-monitor {
output {
interface ge-0/0/10.0;
}
}
}
...
firewall family ethernet-switching {
filter watch-employee {
term employee-to-corp {
from {
destination-address 192.0.2.16/28;
source-address 192.0.2.16/28;
}
then accept {
}
term employee-to-web {
from {
destination-port 80;
}
then analyzer employee-web-monitor;
}
}
}
...
interfaces {
ge-0/0/0 {
unit 0 {
family ethernet-switching {
port-mode trunk;
vlan members [employee-vlan, voice-vlan];
filter {
input watch-employee;
}
3547 Copyright © 2010, Juniper Networks, Inc.
Chapter 127: Port Mirroring