I have a juniper ex2200c with a trunked uplink and an access port on a vlan. I plug a device into the access port and port mirror the access port and the uplink (at different times, as you can only have one analyzer at a time). I see dhcp requests come in the access port, but only CDP packets go out the uplink on the vlan (tshark for the device mac address). STP is not enabled on the 2200. I'm not sure what would allow some packets to be forwarded and not others. It's a simple config, the only firewall is on lo0 for controlling access to the 2200 itself.
Lightly redacted config:
## Last commit: 2022-11-17 08:40:26 PST by alan
version 15.1R7-S12;
interfaces {
ge-0/0/0 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members vlan3999;
}
}
}
}
...
ge-0/0/10 {
description "Mirror tap";
unit 0 {
family ethernet-switching;
}
}
ge-0/0/11 {
description "Phone connection";
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members vlan24;
}
}
}
}
ge-0/1/0 {
description "Uplink";
unit 0 {
family ethernet-switching {
port-mode trunk;
vlan {
/* Phone VLAN */
members vlan24;
}
/* Local Engineering VLAN */
native-vlan-id 3999;
}
}
}
ge-0/1/1 {
unit 0 {
family ethernet-switching;
}
}
lo0 {
unit 0 {
family inet {
filter {
input acl99;
}
}
}
}
vlan {
unit 24 {
description "Phone LAN";
family inet {
address 10.64.24.21/24;
}
}
unit 3999 {
description "Engineering LAN";
family inet {
address 10.64.18.21/24;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop 10.64.18.1;
}
}
protocols {
lldp {
interface all;
}
lldp-med {
interface all;
}
}
policy-options {
prefix-list all {
0.0.0.0/0;
}
prefix-list acl99 {
10.64.18.0/24;
}
prefix-list acl98 {
10.64.18.0/24;
}
}
firewall {
family inet {
filter acl99 {
term ssh_telnet_allow {
from {
source-prefix-list {
acl99;
}
destination-port [ ssh telnet http ];
}
then accept;
}
term ssh_telnet_deny {
from {
source-prefix-list {
all;
}
destination-port [ ssh telnet http ];
}
then {
discard;
}
}
term snmp_allow {
from {
source-prefix-list {
acl98;
}
destination-port 161;
}
then accept;
}
term snmp_deny {
from {
source-prefix-list {
all;
}
destination-port 161;
}
then {
discard;
}
}
term ntp_allow {
from {
source-prefix-list {
acl98;
}
destination-port 123;
}
then accept;
}
term ntp_deny {
from {
source-prefix-list {
all;
}
destination-port 123;
}
then {
discard;
}
}
term everything_else {
then accept;
}
}
}
}
ethernet-switching-options {
analyzer phone {
ratio 1;
loss-priority low;
input {
ingress {
interface ge-0/0/11.0;
}
egress {
interface ge-0/0/11.0;
}
}
output {
interface {
ge-0/0/10.0;
}
}
}
inactive: analyzer uplink {
ratio 1;
loss-priority low;
input {
ingress {
interface ge-0/1/0.0;
}
egress {
interface ge-0/1/0.0;
}
}
output {
interface {
ge-0/0/10.0;
}
}
}
storm-control {
interface all;
}
}
vlans {
vlan24 {
description "Phone VLAN";
vlan-id 24;
l3-interface vlan.24;
}
vlan3999 {
description "Engineering LAN";
vlan-id 3999;
l3-interface vlan.3999;
}
}
