HP 6200YL Installation guide

© 2006 Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
The ProCurve 3500yl/5400zl/6200yl Switch
Software Update NPI Technical Training
NPI Technical Training
Version 1.0b
6 December 2006

© 2006 Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
Traffic Mirroring Section

3
Traffic Mirroring
Allows you to monitor traffic to detect threats or troubleshoot
problems
Advantages
•Allows you to monitor traffic from the local switch or from multiple
remote switches
•Eliminates the need for a monitoring port on every switch
•Reduces the number of necessary security appliances
Network
Stations 5400zl Switch
3500yl Switch
IDS/IPS*
1
2
3
Traffic is selected based
on port, VLAN, or ACL.
Selected traffic is mirrored
to another switch.
Destination switch
forwards mirrored
traffic to IDS/IPS.
hpprocurve
Gig-T/GBIC
xlmodule
J4907A xl module
10/100/1000-TPorts(1-14,15T,16T)-portsareIEEEAutoMDI/MDI-X Dual-PersonalityPorts:10/100/1000-T(T)orMini-GBIC(M)
1
8
2
9
3
10
4
11
5
12
6
13
7
14
1
8 14
Useonlyone(TorM)foreachDual-PersonalityPort
LinkMode
LinkMode T15 T16M M
hpprocurve
Gig-T/GBIC
xlmodule
J4907A xlmodule
10/100/1000-TPorts(1-14,15T,16T)-portsareIEEEAutoMDI/MDI-X Dual-PersonalityPorts:10/100/1000-T(T)orMini-GBIC(M)
1
8
2
9
3
10
4
11
5
12
6
13
7
14
1
8 14
Useonlyone(TorM)foreachDual-PersonalityPort
LinkMode
LinkModeT15 T16M M
*Intrusion detection system (IDS)/ Intrusion prevention system (IPS)

4
Remote Traffic Mirroring
Allows you to monitor traffic to detect threats or troubleshoot
problems from across the network and bring information back to
the analyzer.
Network
Stations 5400zl Switch
3500yl Switch
IDS/IPS*
hpprocurve
Gig-T/GBIC
xlmodule
J4907A xl module
10/100/1000-TPorts(1-14,15T,16T)-portsareIEEEAutoMDI/MDI-X Dual-PersonalityPorts:10/100/1000-T(T)orMini-GBIC(M)
1
8
2
9
3
10
4
11
5
12
6
13
7
14
1
8 14
Useonlyone(TorM)foreachDual-PersonalityPort
LinkMode
LinkMode T15 T16M M
hpprocurve
Gig-T/GBIC
xlmodule
J4907A xlmodule
10/100/1000-TPorts(1-14,15T,16T)-portsareIEEEAutoMDI/MDI-X Dual-PersonalityPorts:10/100/1000-T(T)orMini-GBIC(M)
1
8
2
9
3
10
4
11
5
12
6
13
7
14
1
8 14
Useonlyone(TorM)foreachDual-PersonalityPort
LinkMode
LinkModeT15 T16M M
*Intrusion detection system (IDS)/ Intrusion prevention system (IPS)

5
Guidelines for Using Traffic
Mirroring
Two types of traffic mirroring:
•Local mirroring—source and destination are on the same switch
•Remote mirroring—source and destination are on different switches
Each switch can be the:
•Originator for four mirror sessions, with the destination on either the
local switch or another switch
•Destination for 32 mirror sessions
Network
5400zl Switch
3500yl Switch
IPS/IDS
hpprocurve
Gig-T/GBIC
xlmodule
J4907A xl module
10/100/1000-TPorts(1-14,15T,16T)-portsareIEEEAutoMDI/MDI-X Dual-PersonalityPorts:10/100/1000-T(T)orMini-GBIC(M)
1
8
2
9
3
10
4
11
5
12
6
13
7
14
1
8 14
Useonlyone(TorM)foreachDual-PersonalityPort
LinkMode
LinkMode T15 T16M M
hpprocurve
Gig-T/GBIC
xlmodule
J4907A xlmodule
10/100/1000-TPorts(1-14,15T,16T)-portsareIEEEAutoMDI/MDI-X Dual-PersonalityPorts:10/100/1000-T(T)orMini-GBIC(M)
1
8
2
9
3
10
4
11
5
12
6
13
7
14
1
8 14
Useonlyone(TorM)foreachDual-PersonalityPort
LinkMode
LinkModeT15 T16M M
Four mirror sessions originate on
the local 5400zl Switch.
The 3500yl Switch can receive
up to 28 additional mirror
sessions.

6
Guidelines for Using Traffic
Mirroring
Continued
For local mirroring, configure exit ports:
•Configure multiple mirror sessions to use the same exit port
•Load balance mirror sessions across multiple exit ports
1357 11
812246 Core
IDS/IPS
9
10
2
1

7
Overview of Configuration
Steps
1. Configure the destination switch for remote traffic
mirroring.
2. Configure the source switch.
•Define the session number and the destination for the mirror
session on the source switch.
–Local traffic mirroring—port on the same switch
–Remote traffic mirroring—another 3500yl, 5400zl, or 6200yl Switch
•Define the source interface and the direction of traffic
–Ports, including mesh ports
–Static trunks
–Static virtual LANs (VLANs)
–Direction of traffic—inbound, outbound, or both directions
•Apply an optional Access Control List (ACL) to further select traffic.
–Select inbound traffic on the source interface with an extended or
standard ACL

8
Overview of Configuration
Steps
3. For remote traffic mirroring, enable jumbo frames to
mirror information fields larger than 1446 bytes
(untagged) or (tagged)
• On both source and destination switches
• Any infrastructure switches in between
• The end stations, in this case the IPS/IDS if you know the
originating frame was larger than 1522 bytes.
5400zl Switch
3500yl Switch
IPS/IDS
hpprocurve
Gig-T/GBIC
xlmodule
J4907A xl module
10/100/1000-TPorts(1-14,15T,16T)-portsareIEEEAutoMDI/MDI-X Dual-PersonalityPorts:10/100/1000-T(T)orMini-GBIC(M)
1
8
2
9
3
10
4
11
5
12
6
13
7
14
1
8 14
Useonlyone(TorM)foreachDual-PersonalityPort
LinkMode
LinkMode T15 T16M M
hpprocurve
Gig-T/GBIC
xlmodule
J4907A xlmodule
10/100/1000-TPorts(1-14,15T,16T)-portsareIEEEAutoMDI/MDI-X Dual-PersonalityPorts:10/100/1000-T(T)orMini-GBIC(M)
1
8
2
9
3
10
4
11
5
12
6
13
7
14
1
8 14
Useonlyone(TorM)foreachDual-PersonalityPort
LinkMode
LinkModeT15 T16M M Mirror session originates on the
local 5400zl Switch.
The destination is on
the remote 3500yl
Switch.
ProCurve (config)# vlan <vlan_id> jumbo

9
Configuring the Destination
Switch
1. For remote traffic mirroring, configure the source and destination of
the mirror session on the destination switch
ProCurve_dst_switch(config)# mirror endpoint ip <src-ip-add>
<src-udp-port> <dst-ip-add> port <port#>
Options
IP address of the VLAN or subnet for the exit
port on the destination switch
<dst-ip-add>
The unique UDP port number to use for the
session
<src-udp-port>
Exit port on the destination switch
IP address of the VLAN or subnet on which the
mirrored traffic enters or leaves the source
switch
<port#>
<src-ip-add>
These settings
must match the
settings you will
configure on the
source switch.

10
Configuring the Source Switch
Remote traffic mirroring
2. Configure the source switch
—For remote traffic mirroring, identify the mirror session, the source,
and the destination.
–Replace <1-4> with the number to identify this mirror session.
–Assign an optional name if you want an easier way to identify the session.
–Ensure the other settings match those configured on the destination
switch.
ProCurve_source_switch(config)# mirror <1-4> [name <name>]
remote ip <src-ip-add> <src-udp-port> <dst-ip-add>