Differences

This shows you the differences between two versions of the page.

--- en:dpi:dpi_brief:install_point_ssg:instruction_instal_mirror:start [2023/09/04 09:34] – ↷ Links adapted because of a move operation elena.krasnobryzh
+++ en:dpi:dpi_brief:install_point_ssg:instruction_instal_mirror:start [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1
@@ Line 1: / Line 1: @@
-====== The SSG installation manual using MIRRORING installation scheme ======
-{{indexmenu_n>4}}
-  - Install and start the Stingray SG, please refer to the  [[en:dpi:dpi_brief:dpi_requirements|installation requirements]]
-  - Set an [[en:veos:first_install:ipsetincenos|IP address]]
-  - Apply for license and fastDPI installation to Service Desk
-  - Once installed both, you should edit the following settings:
-Configure mirror traffic reception and response:
-The settings are changed by editing the configuration file /etc/dpi/fastdpi.conf. Let's assume that the SSG is connected as follows:
-  * ''dna1, dna2, dna3'' – receive the mirror traffic
-  * ''dna0'' – connected to a router that receives and forwards responses to subscribers and to the internet.
-To set the DPI in mirroring mode, you have to specify the following in the configuration:
-In the configuration for the inbound ports ''in_dev'' set the ports that accept mirror traffic:
-<code bash>
-in_dev=dna1:dna2:dna3
-</code>
-In the configuration for outgoing ports ''tap_dev'' set the port to which the forwarding response is sent:
-<code bash>
-tap_dev=dna0
-</code>
-Specify the mode – asymmetric
-<code bash>
-asym_mode=1
-</code>
-Specify the direction of ''tap_dev'' responses:
-<code bash>
-emit_direction=2
-tap_mode=
-</code>
-<note important>To send responses in mirroring mode it is correct to use an additional 1GbE card such as intel i350 (+ DNA license), configure a separate port in the system to send **tap_dev** forwarding, and use 10GbE ports for **in_dev** mirrored traffic flows.</note>
-Specify that VLAN should be reset:
-<code bash>
-strip_tap_tags=1
-</code>
-Set MAC change:
-<code bash>
-replace_source_mac=00:25:90:E9:43:59 #- MAC address of card out_dev - dna0
-replace_destination_mac=78:19:F7:0E:B1:F4 #- MAC address of the router, or the routing switch
-</code>
-Set the number of retries if there are network losses:
-<code bash>
-emit_duplication=3
-#here, 3 is the number of repetitions (duplicates) of a packet with redirect or blocking.
-</code>
-===== Implementation scheme and description of operation =====
-{{ en:dpi:dpi_brief:install_point_ssg:mirror_en.png?nolink&900 |}}
-<note important>When a request for a restricted resource is detected, the SSG sends an HTTP redirect to a placeholder page to the subscriber (IP1). A TCP RST packet is sent to the restricted resource (IP2) to drop the connection. Blocking (HTTPS) and redirecting (HTTP) occurs because the SSG responds to the request from IP1 faster than IP2.</note>
-===== Header of the IP response packet =====
-  - **Destination MAC** – MAC address of the router port where the response link is connected.
-  - **Source MAC** – MAC address of the ''out_dev'' card.
-  - **Source IP** – IP address of the restricted resource IP2.
-  - **Destination IP** – IP address of user IP1.
-===== Router configuration example =====
-Configuration example:
-The port on the router where the response link from the SSG is connected should be configured as a regular L3 port. The task is to receive a packet from the SSG and, based on the common routing tables, forward it to the subscriber.
-''Eth1'' is connected to the Juniper MX side
-<code bash>
-#Settings on tha MX side:
-description from_SSG_redirect;
-unit 0 {
-  family inet {
-  address a.b.c.d/30;
-  }
-}
-</code>
-===== Statistics collection =====
-<code bash>
-http_parse_reply=1
-netflow=8
-netflow_full_collector_type=2
-netflow_dev=eth3
-netflow_timeout=20
-netflow_full_collector=172.18.254.124:1500
-netflow_rate_limit=30
-netflow_passive_timeout=40
-netflow_active_timeout=120
-#URL upload
-ipfix_dev=eth3
-ipfix_tcp_collectors=172.18.254.124:1501
-ipfix_observation=127
-#SIP
-ipfix_meta_tcp_collectors=172.18.254.124:1511
-rlimit_fsize=32000000000
-</code>
-Further settings are made depending on which components are to be used and are described in [[en:dpi:dpi_components:start|section 3]].