I am mirroring a port that has the following ACL applied to a port's egress and see traffic not destined to 00:a0:aa:d0:01:08 in the captures. Does the mirror look at traffic before it hits the ACL or after?
entry host8{
if {
ethernet-destination-address 00:a0:aa:d0:01:08;
}
then {permit;}
}
entry DenyAll{
if{
source-address 0.0.0.0/0;
} then {deny;
count block_acl;
}
Thank you for any insight you are able to provide.
