Configure VN-Tag Stripping

Follow this procedure to strip VN tags to support the encapsulation type expected by your traffic-analysis tools.

About this task

The vn-tag cannot be enabled if the br-tag is already enabled in the same listener policy.

Procedure

  1. Enter the Config mode.
    device(config)# 
  2. Configure an ACL of type IPv4, IPv6, or MAC and any actions.
    device(config)# ipv6 access-list acl2-ipv6
    device(config-ipv6-acl)# seq 9 permit ipv6 any any count
    The specified ACL and configured actions will be bound to a listener policy.
  3. Create the listener policy, including any action subcommands for the policy.
    Note

    Note

    A listener policy supports only one IPv4 ACL, IPv6 ACL, or MAC ACL.
    device(config)# listener-policy lp-11 43
    device(config-listener-policy)# match ipv6 access-list acl2-ipv6
    device(config-listener-policy)# strip vn-tag
    device(config-listener-policy)# description "LP for vn tag strippin ipv6"
  4. Configure an egress policy, and bind the listener policy, specifying any additional egress actions.
    Note

    Note

    An egress can be associated with only one listener policy.
    device(config)# egress e7
    device(config-egress)# set listener-policy lp-11 43
    device(config-egress)# precedence 1 interface ethernet 2/14
  5. Configure an egress group and associate it with the egress policy.
    device(config)# egress-group eg_9 
    device(config-egress-group)# description e-group_9
    device(config-egress-group)# set egress e7
  6. Configure the route map and set any other parameters, such as forwarding actions, match ip access list, and the egress-group.
    Note

    Note

    A route-map policy supports only one match-ACL per layer.
    device(config)# route-map R4 10 
    device(config-route-map)# match ipv6 access-list acl2-ipv6
    device(config-route-map)# set egress-group eg_9
    device(config-route-map)# forward-action permit
  7. Configure an ingress group and associate a route map.
    Note

    Note

    An ingress group can be associated with only one route map.
    device(config)# ingress-group TAP_TRAFFIC_2
    device(config-ingress-group)# set route-map R4
  8. Configure the interface port and channel for ingress traffic.
    Note

    Note

    In the following example, traffic is coming in on slot/port number 2/3.
    interface ethernet 2/3
    description From_TAP
    set ingress-group TAP_TRAFFIC_2
    no shutdown
  9. Configure the interface port and channel for egress traffic.
    Note

    Note

    In the following example, traffic is leaving on slot/port number 2/14.
    interface ethernet 2/14
    description To_Tool
    no shutdown