Configuring Mirroring mode

Mirroring mode enables you to stream the same event data to all connected appliances, known as mirroring. Mirroring mode supports ports 16022 and 16023.

About this task

Note: Do not enable Mirror mode if aggregation of appliances is occurring. Aggregation of appliances included in one or more S-TAPs operating in Mirror mode may result in duplicate events and alerts.
In Mirroring mode, you need to configure and activate the policy only for the primary appliance you specify with parameter APPLIANCE_SERVER. If a connection outage occurs, and connectivity continues to be successfully established with a failover appliance specified by APPLIANCE_SERVER_n, the policy pushed by the primary appliance continues to be the active policy.
Note: In Hot Failover, Multistream, and Mirroring mode, you need to configure and activate the policy only for the primary appliance.

Procedure

  1. Specify the IP address or hostname of the primary appliance server using keyword APPLIANCE_SERVER.
  2. Set the value of parameter APPLIANCE_SERVER_LIST to MIRROR.
  3. Specify the number of failover appliances using keyword APPLIANCE_SERVER_n where n=1-5
  4. To prevent data loss, define spill areas using keyword OUTAGE_SPILLAREA_SIZE().

Example

Example Mirroring configuration:

APPLIANCE_SERVER(192.168.2.100)
APPLIANCE_SERVER_LIST(MIRROR)
APPLIANCE_SERVER_1(192.168.2.101)
APPLIANCE_SERVER_2(192.168.2.102)
OUTAGE_SPILLAREA_SIZE(15)