交换机镜像配置端口镜像将交换机或路由器上一个或多个端口 （被镜像端口）的数据复制到一个指定的目的端口 （监听端口）上，通过镜像可以在监听端口上获取这些被镜像端口的数据，以便进行网络流量 分析、错误诊断等。流镜像流镜像就是将匹配访问控制列表规则的业务流复制到指定的监控端口，用于报文的分析 和监视。华为S5700配置ACL规则(基于流的镜像)TSA-5700acl number 3000INTEGER Basic access-list(add to current using rules)INTEGER Advanced access-list(add to current using rules)TSA-3900-acl-adv-3000rule 1 permit tcptcp-flag acksyn TSA-3900-acl-adv-3000rule 5 permit tcp destination-port eq80 TSA-5700-acl-adv-3000quit配置观察口TSA-5700observe-port 1 interface GigabitEthernet 0/0/3配置源端口TSA-5700interfaceGigabitEthernet 0/0/5 TSA-5700-GigabitEthernet0/0/5port-mirroring to observe-port 1 both both Both(inbound and outbound) inboundInbound outboundOutbound/镜像是both则ACL发布规则方向只有inbound/镜像是inbound ACL发布规则方向：inbound/镜像是outbound ACL发布规则方向：outbound TSA-5700-GigabitEthernet0/0/5display port-mirroringTSA-5700-GigabitEthernet0/0/5traffic-mirror inbound acl 3000 rule 1 to observe -port 1traffic-mirror发布镜像端口规则H3CS3600配置观察口H3Cmirroring-group 1 monitor-port GigabitEthernet 0/3配置源端口H3Cmirroring-group 1 mirroring-port GigabitEthernet 0/4 inbound配置ACL规则(基于流的镜像)#创建ACL,其中第1条匹配带有ack标志位的TCP连接报文，第2条匹配TCP连接syn报 文H3Cacl number 3000H3C-acl-adv-3000rule 0 permit tcpack 1H3C-acl-adv-3000rule1 permit tcpsyn 1H3C-acl-adv-3000quit#创建流分类，匹配相应的ACLH3Ctraffic classifier1H3C-classifier-3000if-match acl3000H3C-classifier-3000quit#创建流行为，permit带有syn、ack标志位的TCP连接报文。H3Ctraffic behavior 1H3C-behavior-1filter permitH3C-behavior-1quit#创建Qos策略，关联流分类和流行为。H3Cqos policy 1H3C-qospolicy-1classifier 1 behavior 1#在端口入方向下发Qos策略H3Cinterface GigabitEthernet 0/13H3C-GigabitEthernet0/13 qos apply policy 1 inboundRuijie S5750创建一个会话(全局配置)monitor session 向会话条目添加源或目的端口 (接口配置)monitor session destination | source direction both | tx | rx 查看镜像配置show monitor创建acl规则ruijie(config)#access-list 100 permit tcp any any match-all synack ruijie(config)#access-list 100 permit tcp any anyeq 80在源端口上发布acl规则ruijie(config)#monitor session 1 source interface GigabitEthernet 0/3 rxacl 100H3C S10508#进入系统视图。 system-view#配置基本IPv4 ACL 2000,匹配源IP地址为192.168.0.1的报文。Sysname acl number 2000Sysname-acl-basic-2000 rule permit source 192.168.0.1 0Sysname-acl-basic-2000 quit#配置流分类规则，使用基本IPv4 ACL 2000进行流分类。Sysname traffic classfier 1Sysname-classifier-1 if-match acl 2000Sysname-classifier-1 quit#配置流行为，定义流镜像到GigabitEthernet 2/0/2的动作。Sysname traffic behavior 1Sysname-behavior-1 mirror-to interface GigabitEthernet 2/0/2Sysname-behavior-1 filter permitSysname-behavior-1 quit#配置QoS策略1，为流分类1指定流行为1。Sysname qos policy 1Sysname-policy-1 classifier 1 behavior 1Sysname-policy-1 quit# 将 QoS 策略应用到端口 GigabitEthernet 2/0/1 上。Sysname interface GigabitEthernet 2/0/1Sysname-GigabitEthernet2/0/1 qos apply policy 1 inbound完成上述配置后，用户可以在数据监测设备上对Host A发出的所有报文进行分析监控。华为9系observe-port 1 interface GigabitEthernet11/0/1配置观察端口acl number 3000rule 5 permit tcptcp-flag acksynrule 10 permit tcp destination-port eq www配置ACLtraffic classifier liujingxiang1 operator or precedence 5 if-matchacl 3000配置流分类traffic behavior liujingxiang1mirroring to observe-port 1 配置流动作 traffic policy liujingxiang1classifier liujingxiang1 behavior liujingxiang1配置流策略interface GigabitEthernet8/0/11 traffic-policy liujingxiangl inbound