Known Behavior
29
Release 11.0.2
Packet Mirroring
The ES2 10G LM supports the packet mirroring feature when the module is
paired with the ES2-S2 10GE PR IOA, the ES2-S1 GE-8 IOA, or the ES2-S3 GE-20
IOA. When you use the ES2 10G LM with these IOAs, CLI-based
interface-specific mirroring is not supported.
When both interface-specific mirroring and user-specific mirroring are
configured on the same interface, the interface-specific secure policies take
precedence. The interface-specific secure policies, which you manually attach
using the CLI, override and remove any existing secure polices that were
attached by a trigger action. If the interface-specific secure polices are
subsequently deleted, the original trigger-based secure policies are not
restored.
Typically, when configuring packet mirroring, you configure a static route to
reach the analyzer device through the analyzer port. If the analyzer port is an
IP-over-Ethernet interface, you must also configure a static Address Resolution
Protocol (ARP) entry to reach the analyzer device. However, because only a
single static ARP entry can be installed for a given address at any given time,
when you are using equal-cost multipath (ECMP) links to connect to the
analyzer device, the static ARP configuration does not provide failover if the
link being selected fails or is disconnected. Therefore, to provide continued
connectivity if the link fails when using ECMP, enable the
ip proxy-arp
unrestricted
command on the next-hop router for each ECMP interface. As a
result, when the link fails, the router sends an ARP request to identify the MAC
address of the analyzer device and gets a response over the new link.
Policy Management
In JunosE Release 11.0.0 and higher-numbered releases, you must specify at
least one option by which the router defines a packet flow in order to configure
classifier control lists (CLACLs) for policy lists to be attached to VLAN interfaces.
Although a carriage return,
<cr>
, is displayed when you type a question mark
(
?
) after entering the
vlan classifier list
classifierName
command without
defining any other keyword or CLACL option, an error message is displayed
when you press
Enter
to configure the VLAN CLACL with only the name. The
error message states that a VLAN classifier list cannot be configured without
any classification criteria, such as color, traffic class, user packet class, or user
priority. You must specify at least one keyword or option to configure VLAN
CLACL successfully. [Defect ID 184139].
In JunosE releases earlier than Release 11.0.0, you could configure all CLACLs
(except those CLACLs that were attached to IP interfaces) without specifying an
option or a keyword. Because the policy management application treats only
one default classifier group (configured with an * in the policy list) as a valid
setting, this functionality change ensures that only one classifier that matches
all packets can be present in a VLAN policy list definition.
You cannot configure classifier lists that reference multiple fields for a VLAN
policy list on the ES2 10G Uplink LM or the ES2 10G LM, with the exception of
traffic-class and color. The system incorrectly classifies VLAN policies that
classify using multiple fields. For example, an invalid policy list that references
multiple fields uses both color and user-packet-class, or one classifier list using
color and another using user-packet-class.
