enable mirror to remote-ip

Description

Enables traffic to be mirrored to the specified remote IPv4 destination address encapsulated in a GRE tunneled packet.

Syntax Description

Default

If a VR is not specified, the VR of the current command context is used.

Ping health check of the remote IP address is enabled unless otherwise specified.

The default priority value is 50.

Usage Guidelines

This command enables hardware mirroring of Ethernet frames to a specified remote IPv4 address, which can reside zero or more router hops away. This is useful for ExtremeAnalytics Application Telemetry or other forms of remote network analysis or monitoring.

Port mirroring configures the switch to copy all traffic associated with one or more ports, VLANS or virtual ports. A virtual port is a combination of a VLAN and a port. The monitor port(s) can be connected to a network analyzer or RMON probe for packet analysis. The switch uses a traffic filter that copies a group of traffic to the monitor port.

Up to 16 mirroring filters and up to four monitor ports can be configured on the switch. After a port has been specified as a monitor port, it cannot be used for any other function. Frames that contain errors are not mirrored.

You cannot run ELSM and mirroring on the same port. If you attempt to enable mirroring on a port that is already enabled for ELSM, the switch returns a message similar to the following:

Error: Port mirroring cannot be enabled on an ELSM enabled port.

For high availability, you can add up to four redundant remote IP addresses. When creating a mirror with this command, you can add one IP address. To add additional remote IP addresses, use the configure mirror mirror_name {to [port port | port-list port_list | loopback port port] | remote-ip {add} remote_ip_address {{vr} vr_name } {from [source_ip_address | auto-source-ip]} {ping-check [on | off]}] {remote-tag rtag | port none} {priority priority_value}command.

Standalone Switches and SummitStacks

The traffic filter can be defined based on one of the following criteria:

• Physical port—All data that traverses the port, regardless of VLAN configuration, is copied to the monitor port(s). You can specify which traffic the port mirrors:
  • Ingress—Mirrors traffic received at the port.
  • Egress—Mirrors traffic sent from the port.

  • Ingress and egress—Mirrors traffic either received at the port or sent from the port.

    (If you omit the optional parameters, all traffic is forwarded; the default for port-based mirroring is ingress and egress).

• VLAN—All data to a particular VLAN, regardless of the physical port configuration, is copied to the monitor port.
• Virtual port—All data specific to a VLAN on a specific port is copied to the monitor port.
• ExtremeSwitching series switches support a maximum of 128 mirroring filters with the restriction that a maximum of 16 VLAN and/or virtual port (port + VLAN) filters may be configured.
• ExtremeXOS supports up to 16 monitor ports for one-to-many mirroring.
• Only traffic ingressing a VLAN can be monitored; you cannot specify ingressing or egressing traffic when mirroring VLAN traffic.
• Ingress traffic is mirrored as it is received (on the wire).
• Packets which match both an ingress filter and an egress filter will result in two packets egressing the monitor port or ports.
• In normal mirroring, a monitor port cannot be added to a load share group. In one-to-many mirroring, a monitor port list can be added to a load share group, but a loopback port cannot be used in a load share group.
• You can run mirroring and sFlow on the same device when you are running ExtremeSwitching series switches.
• With a monitor port or ports on ExtremeSwitching series switches, all traffic ingressing the monitor port or ports is tagged only if the ingress packet is tagged. If the packet arrived at the ingress port as untagged, the packet egress the monitor port or ports as untagged.
• Two packets are mirrored when a packet encounters both an ingress and egress mirroring filter.

SummitStack Only

• Physical port—All data that traverses the port, regardless of VLAN configuration, is copied to the monitor port(s). You can specify which traffic the port mirrors:
  • Ingress—Mirrors traffic received at the port.
  • Egress—Mirrors traffic sent from the port.

  • Ingress and egress—Mirrors traffic either received at the port or sent from the port.

    (If you omit the optional parameters, all traffic is forwarded; the default for port-based mirroring is ingress and egress).

• VLAN—All data to a particular VLAN, regardless of the physical port configuration, is copied to the monitor port.
• Virtual port—All data specific to a VLAN on a specific port is copied to the monitor port.
• SummitStack supports a maximum of 128 mirroring filters with the restriction that a maximum of 16 VLAN and/or virtual port (port + VLAN) filters may be configured.
• ExtremeXOS supports up to 16 monitor ports for one-to-many mirroring.
• Only traffic ingressing a VLAN can be monitored; you cannot specify ingressing or egressing traffic when mirroring VLAN traffic.
• Ingress traffic is mirrored as it is received (on the wire).
• Two packets are mirrored when a packet encounters both an ingress and egress mirroring filter.
• When traffic is modified by hardware on egress, egress mirrored packets may not be transmitted out of the monitor port as they egressed the port containing the egress mirroring filter. For example, an egress mirrored packet that undergoes VLAN translation is mirrored with the untranslated VLAN ID. In addition, IP multicast packets which are egress mirrored contain the source MAC address and VLAN ID of the unmodified packet.
• You cannot include the monitor port for a SummitStack in a load-sharing group.
• You can run mirroring and sFlow on the same device when you are running a SummitStack.
• With a monitor port or ports, the mirrored packet is tagged only if the ingress packet is tagged (regardless of what module the ingressing port is on). If the packet arrived at the ingress port as untagged, the packet egress the monitor port(s) as untagged.
• You may see a packet mirrored twice. This occurs only if both the ingress mirrored port and the monitor port or ports are on the same one-half of the module and the egress mirrored port is either on the other one-half of that module or on another module.
• When traffic is modified by hardware on egress, egress mirrored packets may not be transmitted out of the monitor port as they egressed the port containing the egress mirroring filter. For example, an egress mirrored packet that undergoes VLAN translation is mirrored with the untranslated VLAN ID. In addition, IP multicast packets which are egress mirrored contain the source MAC address and VLAN ID of the unmodified packet.
• The configuration of remote-tag does not require the creation of a VLAN with the same tag; on these platforms the existence of a VLAN with the same tag as a configured remote-tag is prevented. This combination is allowed so that an intermediate remote mirroring switch can configure remote mirroring using the same remote mirroring tag as other source switches in the network. Make sure that VLANs meant to carry normal user traffic are not configured with a tag used for remote mirroring.
• When a VLAN is created with remote-tag, that tag is locked and a normal VLAN cannot have that tag. The tag is unique across the switch. Similarly if you try to create a remote-tag VLAN where remote-tag already exists in a normal VLAN as a VLAN tag, you cannot use that tag and the VLAN creation fails.

History

This command was first available in ExtremeXOS 22.4.

Redundant remote IP addresses capability was added in ExtremeXOS 30.4.

Platform Availability

This command is available on ExtremeSwitching X435, X440-G2, X450-G2, X460-G2, X465, X590, X620, X670-G2, X690, X695, X870, 5320, 5420, and 5520 series switches.