port mirror issue

  • 0
  • 2
  • Question
  • Updated 3 months ago
  • Answered
I am trying to put together purview in my lab. I had all my devices discovered by netsight and was doing well, however the sensor would not do any analytics stuff. so, I thought it was due to lack of tunnel and mirror. when I tried to create mirror I used the wrong port I put "create mirror name to 1:37" when port 37 was the port I wanted to copy the traffic from. I got an error something about it would remove the port from the monitoring vlan. I (sadly) chose yes and it broke everything because it messed up port 37. how do I undo what ever I messed up?
Photo of Jennifer Smith

Jennifer Smith

  • 80 Points 75 badge 2x thumb
  • disappointed

Posted 3 months ago

  • 0
  • 2
Photo of Eric Burke

Eric Burke

  • 2,428 Points 2k badge 2x thumb
Hey Jennifer... You should be able to simply "delete mirror 'mirrorname'" to clear the changes you made to that port. If you don't have a config with the old pre-mirror settings, you'll have to recreate the original vlan membership and other components.
Photo of Eric Burke

Eric Burke

  • 2,428 Points 2k badge 2x thumb
One more suggestion that I use all of the time - turn on logging in whatever terminal tool you're using (putty for example). Then before making any type of change like this issue the following:

dis clip
sho conf
en clip

This will disable client paging (pauses), dump the current config to screen and re-enable the pause option. By having logging turned on all of the time, you'll have a record of it in the logs you can go back and grab from anytime (even if you didn't save/commit the changes it's often easier to just go back and look at the original setup rather than waiting for a reboot).

Eric
Photo of David Rahn

David Rahn

  • 824 Points 500 badge 2x thumb
Because mirroring deletes the vlans on the port.
You should just reboot, dont save the changes...