enable mirror to remote-ip

enable mirror {mirror_name} to remote-ip remote_ip_address {{vr} vr_name} {from [source_ip_address | auto-source-ip]} {ping-check [on | off]}]

Description

Enables traffic to be mirrored to the specified remote IPv4 destination address encapsulated in a GRE tunneled packet.

Syntax Description

mirror_name	Specifies the mirror instance name.
remote-ip	Specifies to send mirrored packets to specified destination remote IP address.
remote_ip_address	Specifies the remote destination IP address for mirrored packets.
vr	Specifies a virtual router of the remote IP address.
vr_name	Specifies the virtual router name. If not specified, VR of current command context is used.
from	Configures source IP address of encapsulated mirrored packets.
source_ip_address	Specifies the local source IPv4 address for encapsulated mirrored packets.
auto-source-ip	Automatically use source IP address of egress VLAN to be used to reach remote IP address.
ping-check	Configure ping health check for remote IP address.
on	Only send mirrored packets to remote IP address if periodic pings to remote IP address are successful (default).
off	Send mirrored packets to remote IP address without any ping health check, assuming MAC address and port of next hop IP address are static or learned.

Default

If a VR is not specified, the VR of the current command context is used.

Ping health check of the remote IP address is enabled unless otherwise specified.

Usage Guidelines

This command enables hardware mirroring of Ethernet frames to a specified remote IPv4 address, which can reside zero or more router hops away. This is useful for ExtremeAnalytics sFlow+ Collector or other forms of remote network analysis or monitoring.

Port mirroring configures the switch to copy all traffic associated with one or more ports, VLANS or virtual ports. A virtual port is a combination of a VLAN and a port. The monitor port(s) can be connected to a network analyzer or RMON probe for packet analysis. The switch uses a traffic filter that copies a group of traffic to the monitor port.

Up to 16 mirroring filters and up to four monitor ports can be configured on the switch. After a port has been specified as a monitor port, it cannot be used for any other function. Frames that contain errors are not mirrored.

You cannot run ELSM and mirroring on the same port. If you attempt to enable mirroring on a port that is already enabled for ELSM, the switch returns a message similar to the following:

Error: Port mirroring cannot be enabled on an ELSM enabled port.

Standalone Switches and SummitStacks

The traffic filter can be defined based on one of the following criteria:

Physical port—All data that traverses the port, regardless of VLAN configuration, is copied to the monitor port(s). You can specify which traffic the port mirrors:
- Ingress—Mirrors traffic received at the port.
- Egress—Mirrors traffic sent from the port.
- Ingress and egress—Mirrors traffic either received at the port or sent from the port.
  
  (If you omit the optional parameters, all traffic is forwarded; the default for port-based mirroring is ingress and egress).
VLAN—All data to a particular VLAN, regardless of the physical port configuration, is copied to the monitor port.
Virtual port—All data specific to a VLAN on a specific port is copied to the monitor port.
Summit family switches support a maximum of 128 mirroring filters with the restriction that a maximum of 16 VLAN and/or virtual port (port + VLAN) filters may be configured.
ExtremeXOS supports up to 16 monitor ports for one-to-many mirroring.
Only traffic ingressing a VLAN can be monitored; you cannot specify ingressing or egressing traffic when mirroring VLAN traffic.
Ingress traffic is mirrored as it is received (on the wire).
Packets which match both an ingress filter and an egress filter will result in two packets egressing the monitor port or ports.
In normal mirroring, a monitor port cannot be added to a load share group. In one-to-many mirroring, a monitor port list can be added to a load share group, but a loopback port cannot be used in a load share group.
You can run mirroring and sFlow on the same device when you are running Summit family switches.
With a monitor port or ports on Summit family switches, all traffic ingressing the monitor port or ports is tagged only if the ingress packet is tagged. If the packet arrived at the ingress port as untagged, the packet egress the monitor port or ports as untagged.
Two packets are mirrored when a packet encounters both an ingress and egress mirroring filter.

SummitStack Only

The traffic filter can be defined based on one of the following criteria:

Physical port—All data that traverses the port, regardless of VLAN configuration, is copied to the monitor port(s). You can specify which traffic the port mirrors:
- Ingress—Mirrors traffic received at the port.
- Egress—Mirrors traffic sent from the port.
- Ingress and egress—Mirrors traffic either received at the port or sent from the port.
  
  (If you omit the optional parameters, all traffic is forwarded; the default for port-based mirroring is ingress and egress).
VLAN—All data to a particular VLAN, regardless of the physical port configuration, is copied to the monitor port.
Virtual port—All data specific to a VLAN on a specific port is copied to the monitor port.
SummitStack supports a maximum of 128 mirroring filters with the restriction that a maximum of 16 VLAN and/or virtual port (port + VLAN) filters may be configured.
ExtremeXOS supports up to 16 monitor ports for one-to-many mirroring.
Only traffic ingressing a VLAN can be monitored; you cannot specify ingressing or egressing traffic when mirroring VLAN traffic.
Ingress traffic is mirrored as it is received (on the wire).
Two packets are mirrored when a packet encounters both an ingress and egress mirroring filter.
When traffic is modified by hardware on egress, egress mirrored packets may not be transmitted out of the monitor port as they egressed the port containing the egress mirroring filter. For example, an egress mirrored packet that undergoes VLAN translation is mirrored with the untranslated VLAN ID. In addition, IP multicast packets which are egress mirrored contain the source MAC address and VLAN ID of the unmodified packet.
You cannot include the monitor port for a SummitStack in a load-sharing group.
You can run mirroring and sFlow on the same device when you are running a SummitStack.
With a monitor port or ports, the mirrored packet is tagged only if the ingress packet is tagged (regardless of what module the ingressing port is on). If the packet arrived at the ingress port as untagged, the packet egress the monitor port(s) as untagged.
You may see a packet mirrored twice. This occurs only if both the ingress mirrored port and the monitor port or ports are on the same one-half of the module and the egress mirrored port is either on the other one-half of that module or on another module.
When traffic is modified by hardware on egress, egress mirrored packets may not be transmitted out of the monitor port as they egressed the port containing the egress mirroring filter. For example, an egress mirrored packet that undergoes VLAN translation is mirrored with the untranslated VLAN ID. In addition, IP multicast packets which are egress mirrored contain the source MAC address and VLAN ID of the unmodified packet.
The configuration of remote-tag does not require the creation of a VLAN with the same tag; on these platforms the existence of a VLAN with the same tag as a configured remote-tag is prevented. This combination is allowed so that an intermediate remote mirroring switch can configure remote mirroring using the same remote mirroring tag as other source switches in the network. Make sure that VLANs meant to carry normal user traffic are not configured with a tag used for remote mirroring.
When a VLAN is created with remote-tag, that tag is locked and a normal VLAN cannot have that tag. The tag is unique across the switch. Similarly if you try to create a remote-tag VLAN where remote-tag already exists in a normal VLAN as a VLAN tag, you cannot use that tag and the VLAN creation fails.

Example

The following example enables a mirroring instance named "analytics_chicago_1" to mirror packets to the remote IP address 1.2.3.4 with ping health check (default behavior) being performed on the remote IP address:

enable mirror analytics_chicago_1 to remote-ip 1.2.3.4

The following example enables a mirroring instance named "analytics_seattle_2" to mirror packets to the remote IP address 5.6.7.8 from the source IP address 10.1.1.1 without ping health check being performed on the remote IP address:

enable mirror analytics_seattle_2 to remote-ip 5.6.7.8 from 10.1.1.1 ping-check off

History

This command was first available in ExtremeXOS 22.4.

Platform Availability

This command is available on the Summit X450-G2, X460-G2, X670-G2, X770, and ExtremeSwitching X440-G2, X590, X620, X690, X870 series switches.

Published July 2019prev | next

Email this topic

Print this page Print this page

Leave feedback Feedback