Creating a Traffic Mirror

Last updated: 2020-07-13 15:43:00

    You can use a traffic mirror to filter and copy network traffic from an elastic network interface (ENI) of VPC to CVM clusters in the same VPC, which is suitable for scenarios including security audit, troubleshooting and business analysis. This document introduces how to create a traffic mirror.

    Traffic mirror is now in beta test. To apply for it, please submit a ticket. We recommend saving the link to the Traffic Mirror Console, so you can log in to the Console without applying again.

    Prerequisites

    Make sure that the traffic mirror source and traffic mirror target are in the same VPC and the traffic mirror source has a route table entry for the traffic mirror target.

    Directions

    Step 1: create a traffic mirror source

    1. Open the link in response to your [ticket submitted] (https://console.cloud.tencent.com/workorder/category) and log in to Traffic Mirror Console. In the top Region selector, choose the region that you used to create a traffic mirror.

    2. Click +New on the Traffic mirroring page.

      Each VPC supports creating a maximum of 5 traffic mirrors.

    3. Configure the traffic collection as follows:

      • Enter a name for the traffic mirror, which cannot exceed 60 characters.

      • Select a Network.

      • Select a Collection Range:

        • Virtual Private Cloud: all traffic in the VPC except for the mirrored traffic of receiving IPs will be collected, which usually applies to the full mirror scenario.
        • Subnet: all traffic in the subnet of the VPC except for the mirrored traffic of receiving IPs will be collected. When this option is selected, you also need to select specific subnet IP ranges.
        • ENI: all traffic in the VPC except for the traffic of the ENI that is bound to receiving IPs will be collected. When this option is selected, you also need to select specific ENIs.
      • Select a Collection Type: select the traffic direction as needed. There are three options: All traffic, Traffic out and Traffic in.

      • Select a Traffic filtering: select a method to filter out unnecessary traffic and keep the mirror small and lightweight.

        • N/A: all traffic configured will be collected.

        • Quintuple: the traffic that meets quintuple conditions will be collected. When this option is selected, you also need to set Protocol, Source IP range, Destination IP range, Source port, and Destination port. You can optionally click Add to create another filter condition, and only the traffic that meets all of filter conditions will be collected.

        • The next hop is the NAT gateway: when the next hop is the NAT gateway, the traffic will be collected. When this option is selected, you also need to search for a NAT gateway next to Condition.

    4. After completing the configuration, click Next.

    Step 2: create a traffic mirror target

    1. Set the receiving traffic as follows:

      • Receiving IP: enter IP addresses that receive the mirrored traffic.
        • If this field is left empty, no traffic will be mirrored. So enter at least one receiving IP.
        • Separate IPs with line breaks or commas.
        • The traffic generated by the receiving IP in a VPC will not be collected.
      • Balance method: select either of:
        • Evenly distribute traffic: traffic is distributed to the above receiving IPs evenly.
        • HASH by ENI: traffic from the same ENI will be forwarded to the same receiving IP.
    2. After completing the configuration, click OK.

    Result Validation

    Return to the Traffic mirroring page. If the traffic mirror that you just created shows in the list with Collect Traffic enabled, the traffic mirror is created successfully.

    Subsequent Steps

    • Enable or disable the traffic mirror
    • Modify the traffic mirror
    • Add a tag
    • Delete the traffic mirror

    Was this page helpful?

    Was this page helpful?

    • Not at all
    • Not very helpful
    • Somewhat helpful
    • Very helpful
    • Extremely helpful
    Send Feedback
    Help