• match commands define the values that header fields must contain for a packet to belong to the class and
be managed by policy actions.
• ignore commands define the values which, if contained in header fields, exclude a packet from the policy
actions configured for the class.
NOTE: Be sure to enter match/ignore statements in the precise order in which you want their
criteria to be used to check packets.
The following match criteria are supported in match/ignore statements for inbound IPv4/IPv6 traffic:
• IP source address (IPv4 and IPv6)
• IP destination address (IPv4 and IPv6)
• IP protocol (such as ICMP or SNMP)
• Layer 3 IP precedence bits
• Layer 3 DSCP codepoint
• Layer 4 TCP/UDP application port (including TCP flags)
• VLAN ID
Enter one or more match or ignore commands from the class configuration context to filter traffic and
determine the packets on which policy actions will be performed.
3. Create a mirroring policy to configure the session and destination device to which specified classes of inbound
traffic are sent by entering the policy mirror command from the global configuration context.
NOTE: Be sure to enter each class and its associated mirroring actions in the precise order in
which you want packets to be checked and processed.
To configure the mirroring actions that you want to execute on packets that match the criteria in a specified
class, enter one or more class action mirror commands from the policy configuration context.
You can configure only one mirroring session (destination) for each class. However, you can configure the
same mirroring session for different classes.
A packet that matches the match criteria in a class is mirrored to the exit (local or remote) port that has been
previously configured for the session, where session is a value from 1 to 4 or a text string (if you configured the
session with a name when you entered the mirror command.)
Prerequisite: The local or remote exit port for a session must be already configured before you enter the
mirror session parameter in a class action statement:
• In a local mirroring session, the exit port is configured with the mirror <session-number> port
command
• In a remote mirroring session, the remote exit port is configured with the mirror endpoint ip and
mirror <session-number> remote ip commands.
Restriction: In a policy, you can configure only one mirroring session per class. However, you can configure the
same session for different classes.
Mirroring is not executed on packets that match ignore criteria in a class.
296 Aruba 2530 Management and Configuration Guide for
ArubaOS-Switch 16.05
To Next Page