T5000 鏡像旁掛組網

如圖1所示，流量通過交換機進來，交換機將流量通過鏡像上送IPS設備處理，IPS設備配置inline黑洞轉發，對收到的報文處理完後直接丟棄。

1. Switch配置
[H3C]vlan 2              //創建vlan
[H3C-vlan2]qu     
[H3C]mirroring-group 1 local              //配置本地鏡像組
[H3C]int GigabitEthernet 1/0/37  
[H3C-GigabitEthernet1/0/37] port link-mode bridge     //配置接口模式為brige
[H3C-GigabitEthernet1/0/37] port access vlan 2        //允許vlan 2通過
[H3C-GigabitEthernet1/0/37] mirroring-group 1 mirroring-port both   //配置對接口g1/0/37收發的報文都進行鏡像
[H3C-GigabitEthernet1/0/37]qu                                                
[H3C]int GigabitEthernet 1/0/38
[H3C-GigabitEthernet1/0/38] port link-mode bridge        //配置接口模式為brige
[H3C-GigabitEthernet1/0/38] mirroring-group 1 monitor-port    //配置接口g1/0/38為鏡像組的目的端口
[H3C-GigabitEthernet1/0/38] qu
[H3C]int GigabitEthernet 1/0/39  
[H3C-GigabitEthernet1/0/39] port link-mode bridge     //配置接口模式為brige
[H3C-GigabitEthernet1/0/39] port access vlan 2       //允許vlan 2通過

2. 配置IPS
[H3C]vlan 2                 //創建vlan                              
[H3C]int GigabitEthernet 2/0/6      
[H3C-GigabitEthernet2/0/6] port link-mode bridge     //配置接口模式為brige
[H3C-GigabitEthernet2/0/6] port access vlan 2      //允許vlan 2通過
[H3C]bridge 2 blackhole       //創建黑洞模式Bridge轉發實例
[H3C-bridge-2-blackhole] add interface GigabitEthernet2/0/6     //向Bridge轉發實例中添加接口
[H3C]security-zone name  inline               //創建安全域inline
[H3C-security-zone-inline] import interface GigabitEthernet2/0/6 vlan 2    //向安全域中添加接口
[H3C]app-profile 103_103_37255_IPv4          //創建app-profile                      
[H3C-app-profile-103_103_37255_IPv4]  ips apply policy default mode protect   //在app-profile中引用IPS的default策略
[H3C-app-profile-103_103_37255_IPv4]  quit                                      
[H3C]object-policy ip inline-inline          //創建object-policy                 
[H3C-object-policy-ip-inline-inline]  rule  inspect 103_103_37255_IPv4    //引用app-pprofile  
[H3C]zone-pair security source inline destination inline           //配置源域和目的域均為inline的域間策略
[H3C-zone-pair-security-inline-inline] object-policy apply ip inline-inline  //應用object-policy

注意報文的源目安全區域均為接口所在的安全區域。報表上無法區分上下行流量，隻能通過發起地址來判斷