On (2015-03-16 10:34 -0400), Clarke Morledge wrote: Hey,
> I have not been able to figure this one out either. Very frustrating. > > If you do find an answer, please post to the list. I got tip from Max, Eduard and Pete to use 'family any', instead of 'family bridge'. I didn't initially even entertain the idea, because I knew I needed filtering which 'family any' lacks. But with some juggling, I was able to also filter my mirrored packet. Relevant config: set groups SBC:IFD interfaces <*> unit <*> filter input ANY:SBC set groups SBC:IFD interfaces <*> unit <*> filter output ANY:SBC set groups SBC firewall family any filter ANY:SBC term all then port-mirror set groups SBC firewall family any filter ANY:SBC term all then forwarding-class EF set groups SBC firewall family any filter ANY:SBC term all then accept set groups SBC forwarding-options port-mirroring input rate 1 set groups SBC forwarding-options port-mirroring family any output interface lt-0/0/0.0 set groups SBC interfaces lt-0/0/0 unit 0 encapsulation ethernet-ccc set groups SBC interfaces lt-0/0/0 unit 0 peer-unit 1 set groups SBC interfaces lt-0/0/0 unit 1 encapsulation ethernet-vpls set groups SBC interfaces lt-0/0/0 unit 1 peer-unit 0 set groups SBC interfaces lt-0/0/0 unit 1 family vpls filter input VPLS:MIRROR_FILTER set groups SBC interfaces lt-0/0/0 unit 1 family vpls filter output VPLS:DISCARD set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term sip from ip-protocol tcp set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term sip from ip-protocol udp set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term sip from port 5060-5070 set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term sip then count sip set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term sip then accept set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term rtpc from ip-protocol udp set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term rtpc from port 1024-65535 set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term rtpc from flexible-match-mask match-start layer-4 set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term rtpc from flexible-match-mask byte-offset 1 set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term rtpc from flexible-match-mask bit-offset 7 set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term rtpc from flexible-match-mask bit-length 1 set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term rtpc from flexible-match-mask mask-in-hex 0x1 set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term rtpc from flexible-match-mask prefix 0x1 set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term rtpc then count rtpc set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term rtpc then accept set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term discard then count discard set groups SBC firewall family vpls filter VPLS:MIRROR_FILTER term discard then discard set routing-instances MIRROR instance-type vpls set routing-instances MIRROR interface lt-0/0/0.1 set routing-instances MIRROR interface ge-0/1/0.0 set routing-instances MIRROR interface ge-0/1/1.0 set routing-instances MIRROR protocols vpls no-mac-learning set interfaces ge-0/1/1 encapsulation ethernet-vpls set interfaces ge-0/1/1 unit 0 family vpls filter input VPLS:DISCARD set interfaces ge-0/1/0 encapsulation ethernet-vpls set interfaces ge-0/1/0 unit 0 family vpls filter input VPLS:DISCARD set groups SBC firewall family vpls filter VPLS:DISCARD term discard then discard -- ++ytti _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
