User Manual

Enterasys X-Pedition User Reference Manual 419
Layer-3 Security Controls
Enable / Disable
To disable bmon commands, remove them from the active configuration.
Port Mirroring
The port mirroring facility, available in configuration mode, allows the X-Pedition to duplicate
traffic between ports. For additional information, see Configuring the X-Pedition for Port
Mirroring on page 451.
Features Available
A port mirror can be used to duplicate traffic from a single port to another single port, a single port
to multiple ports, multiple ports to a single port, or multiple ports to multiple ports. You may also
use the Port Mirroring facility in conjunction with an ACL. When you set up a mirror for traffic
coming into the X-Pedition that matches a specific ACL, the X-Pedition mirrors the traffic out to
one or more ports.
Note: The X-Pedition supports port mirroring, ACL, and Layer-2 filtering on a per-WAN-card
basis, not a per-port basis.
Note: The X-Pedition does not support port mirroring on ATM ports.
By itself, port mirroring doesn't protect the X-Pedition from intrusion; however, it is very useful
when you work in conjunction with an IDS (Intrusion Detection System) such as Enterasys' Dragon
Sensor. The X-Pedition can mirror traffic to an IDS and the IDS can perform more sophisticated,
customized processing of the packets without inhibiting the X-Pedition's performance—if it finds a
suspicious packet, the IDS can alert the system administrator. Most security systems have some
way to communicate with routers to neutralize any potential threats (e.g., the Dragon Sensor uses
SNMP to communicate with the X-Pedition). Refer to the Enterasys web site for more information
on the Dragon Sensor and other security offerings.
Configuration
If you want to duplicate traffic between ports, you may want set up a port mirror with the mirroring
commands (available in configuration mode). Since you may use a port only once in a single
mirror, you may not use a port in multiple mirrors or set it to mirror itself. Additionally, since the
mirror administratively takes down destination ports in a port mirror, you cannot use them in smart
trunks, ACLs, etc. You can apply mirrors to the following:
• A set of ports
• An ACL
Note: The X-Pedition does not support port mirroring on ATM ports.