Brocade BigIron RX Series Configuration Guide - Manual (Page 230)

152 BigIron RX Series Configuration Guide
53-1002484-04
Mirror ports for Policy-Based Routing (PBR) traffic
6
The PBR mirror interface feature allows continued hardware forwarding and, at the same time,
enables you to determine exactly which traffic flows get routed using the policies defined by PBR.
The following section provides a general overview of hardware-based PBR.
About hardware-based PBR
Hardware-based Policy-Based Routing (PBR) routes traffic in hardware based on policies you
define. A PBR policy specifies the next hop for traffic that matches the policy. A PBR policy also
can use an ACL to perform QoS mapping and marking for traffic that matches the policy.
To configure PBR, you define the policies using IP ACLs and route maps, then enable PBR globally
or on individual interfaces. The device programs the ACLs into the Layer 4 CAM on the interfaces
and routes traffic that matches the ACLs according to the instructions in the route maps. You also
can map and mark the traffic's QoS information using the QoS options of the ACLs.
Configuring mirror ports for PBR traffic
When you configure a physical or virtual port to act as a mirror port for PBR traffic, outgoing
packets that match the permit Access Control List (ACL) clause in the route map are copied to the
mirror ports that you specify. You can specify up to four mirror ports for each PBR route map
instance.
For example, to capture all traffic forwarded to an SSL port and mirror it to port 5/1, enter
commands such as the following.
BigIron RX(config)# route-map ssl-pbr-map permit 1
BigIron RX(config-routemap ssl-pbr-map)# match ip address 100
BigIron RX(config-routemap ssl-pbr-map)# set mirror-interface 5/1
BigIron RX(config-routemap ssl-pbr-map)# set next-hop 10.10.10.1
BigIron RX(config-routemap ssl-pbr-map)# exit
BigIron RX(config)# interface ethernet 5/1
BigIron RX(config-if-e10000-5/1)# port-name mirror-port
BigIron RX(config-if-e10000-5/1)# exit
BigIron RX(config)# interface ethernet 10
BigIron RX(config-if-e10000-10)# ip policy route-map ssl-pbr-map
BigIron RX(config-if-e10000-10)# exit
BigIron RX(config)#access-list 100 permit tcp any any eq ssl
The above commands complete the following configuration tasks.
1. Configures an entry in the PBR route map named “ssl-pbr-map” . The match statement
matches on IP information in ACL 100. The set mirror-interface statement specifies interface e
5 as the mirror port for matched ACL permit clauses. The set next-hop statement sets the IP
address of the route’s next hop router to 10.10.10.1.
2. Identifies interface e 5 as a mirror port by assigning the name “mirror-port”.
3. Enables PBR and applies the route map “ssl-pbr-map” on interface e 10.
4. Creates an extended ACL (100) that permits all TCP traffic destined for an for an SSL port.
Syntax: set mirror-interface <slot number>/<port number>
The <slot number> parameter specifies the port number on a device.
The <port number> parameter specifies the mirror port number.