Solved

mirror port on srx240

Posted on 2015-01-07
3
285 Views
Last Modified: 2015-01-18
I have several srx240 and I'd like to monitor my WAN port with Wireshark. I am new to Juniper. So I am just wondering if anybody can provide some guidance in configuring the mirror port on my srx240.

This is what I intend to setup:
Internet <--ge-0/0/0-->srx240<--ge-0/0/1-->internal network
                                         |
                                 ge-0/0/2 (this is where my PC with Wireshark is connected to)

Thanks
0
Comment
Question by:leblanc
  • 2
3 Comments
 
LVL 25

Accepted Solution

by:
Fred Marshall earned 500 total points
ID: 40536960
Juniper Networks provides the configuration entries necessary to do this at:
http://kb.juniper.net/InfoCenter/index?page=content&id=KB21833
0
 
LVL 1

Author Comment

by:leblanc
ID: 40537005
That looks complex. I see the Security section and I am not sure I understand the implication of it. My FW is in a production environment and I don't want to compromise the security. Does this section mean that it will allow everything to go through the FW?

security {
    policies {
        default-policy {
            permit-all;
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                all;

Open in new window

0
 
LVL 25

Assisted Solution

by:Fred Marshall
Fred Marshall earned 500 total points
ID: 40537070
In some sense, such is the structure of a JUNOS configuration.

You said you wanted to mirror the "WAN" port.  
That means you want to mirror the public side / a port in the untrust zone.
So, *of course* the firewall will let everything through because that's the essential port being firewalled otherwise.
That's what mirroring is supposed to do.
But this is not to say that the firewall will let everything from the Untrust zone to the Trust zone at all.

Perhaps we should talk about normal mirror ports.
Usually they are disconnected from all other ports.
Usually you would connect to them with a separate NIC that may have NO TCP/IP protocol installed because all you're going to do with it is *watch* the traffic and not interact with it.

I do essentially the same thing by mirroring the same port where it enters a switch.  Then I set up a mirror port on the switch.  It's a lot easier than dealing with JUNOS code.
0

Featured Post

Free camera licenses with purchase of My Cloud NAS

Milestone Arcus software is compatible with thousands of industry-leading cameras for added flexibility. Upon installation on your My Cloud NAS, you will receive two (2) camera licenses already enabled in the software. And for a limited time, get additional camera licenses FREE.

Join & Write a Comment

Does your iMac really need a hardware upgrade? Will upgrading RAM speed-up your computer? If yes, then how can you proceed? Upgrading RAM in your iMac is not as simple as it may seem. This article will help you in getting and installing right RA…
I use more than 1 computer in my office for various reasons. Multiple keyboards and mice take up more than just extra space, they make working a little more complicated. Using one mouse and keyboard for all of my computers makes life easier. This co…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now