Wired Intelligent Edge

Hi!

I have two 2939F cascaded switch and I need to monitor all ports traffic to a specific switch port.

In that case we have from 1/1 to 1/48 and 2/1 to 2/48 ports for set up the mirroring excepting port 1/8, that must be the mirror port for all that traffic.

How can I do it? I was looking for in the manual sheet but I haven't found anything clear, thanks for your help in advance!

------------------------------
Barbera James
------------------------------

Hello

Management and Configuration Guide, page 389, section Local Mirroring destination on the local switch

https://support.hpe.com/hpesc/public/docDisplay?docId=a00091307en_us&docLocale=en_US

For your scenario it should look like this

access2# conf
access2(config)# mirror 1 port 1/8
access2(config)#
access2(config)# interface 1/1-1/8,1/9-1/48,2/1-2/48 monitor all both mirror 1

Keep in mind that the mirror port 1/8 cannot be in the list of monitored port.
Instead both directions you can monitor only incoming or outgoint traffic of the monitored ports.
access2(config)# interface 1/-1/8,1/9-1/48,2/1-2/48 monitor all ?
in Monitor all inbound traffic
out Monitor all outbound traffic
both Monitor all inbound and outbound traffic

Mirroring all traffic of 94 productive ports to a single mirror port can create a bottle neck. The volume of mirrored traffic of the ports can be at times too high for a single mirror port to handle and some traffic will be dropped.


------------------------------
Emil Gogushev
------------------------------

Thanks for your fast reply Emil!

Some questions about that:
· If I exclude 1/8, it should not be interface 1/1-1/7,1/9-1/48,2/1-2/48 monitor all both mirror 1 ??
· Some of that ports are connected but don't have traffic, anyway that bottle neck could affect to the other ports peformance?
· And finally, how can I delete that mirror if I have any problem or I need to change the config.

Lots of thanks in advance!

------------------------------
Barbera James
------------------------------

Original Message:
Sent: Feb 08, 2022 02:19 AM
From: Emil Gogushev
Subject: 2930F Port Mirroring

Hello

Management and Configuration Guide, page 389, section Local Mirroring destination on the local switch

https://support.hpe.com/hpesc/public/docDisplay?docId=a00091307en_us&docLocale=en_US

For your scenario it should look like this

access2# conf
access2(config)# mirror 1 port 1/8
access2(config)#
access2(config)# interface 1/1-1/8,1/9-1/48,2/1-2/48 monitor all both mirror 1

Keep in mind that the mirror port 1/8 cannot be in the list of monitored port.
Instead both directions you can monitor only incoming or outgoint traffic of the monitored ports.
access2(config)# interface 1/-1/8,1/9-1/48,2/1-2/48 monitor all ?
in Monitor all inbound traffic
out Monitor all outbound traffic
both Monitor all inbound and outbound traffic

Mirroring all traffic of 94 productive ports to a single mirror port can create a bottle neck. The volume of mirrored traffic of the ports can be at times too high for a single mirror port to handle and some traffic will be dropped.


------------------------------
Emil Gogushev
------------------------------

Hello, 

· If I exclude 1/8, it should not be interface 1/1-1/7,1/9-1/48,2/1-2/48 monitor all both mirror 1 ??

The same port cannot be a destination port of the mirror session (something you configure with "mirror 1 port 1/8") and also be monitored port that means a source of the mirror session. That's why we need to exclude port 1/8 from the list of the monitored ports.  The CLI will give you an error if not excluded. Here for example I am configuring 1/8 as mirror destination and trying also the configure the same port as mirror source (monitored)

Aruba-2930F-24G-4SFPP(config)# mirror 1 port 8
Aruba-2930F-24G-4SFPP(config)# interface 8 monitor all both mirror 1
Monitor port 8 can not be a mirror source port.

The line "interface 1/1-1/7,1/9-1/48,2/1-2/48 monitor all both mirror 1 " is correct. It specifies the interfaces which should be monitored (mirror sources), for stack member 1 this are  1/1 until 1/7, and 1/9 until 1/48. Port 1/8 is not in any of this ranges so it is excluded.



· Some of that ports are connected but don't have traffic, anyway that bottle neck could affect to the other ports performance?
The performance of the other ports won't be affected. But the mirroring will be affected because the network analyzer or IDS/IPS connected to the mirroring destination port 1/8 wont be receiving all the frames mirrored from the rest of the ports.

· And finally, how can I delete that mirror if I have any problem or I need to change the config.
Any command can be undone with "no" in front of it.

Here I am configuring a mirror session nr 1 with destination port 8 and source ports 1 to 7.

Aruba-2930F-24G-4SFPP(config)# mirror 1 port 8
Aruba-2930F-24G-4SFPP(config)# int 1-7 monitor all both mirror 1

The command show monitor is showing you the current status of the mirror session. Note that 7 sources are listed.

Aruba-2930F-24G-4SFPP(config)# show monitor
There are no Remote Mirroring endpoints currently assigned.

Network Monitoring

Sessions Status Type Sources Mirror-Policy
-------- ----------------- ----- ------- -------------
1 active port 7 No
2 not defined
3 not defined
4 not defined

If I want to remove ports 1 to 6 as mirror sources and leave only port 7 I enter the following command. Note that the sources are just 1.

ruba-2930F-24G-4SFPP(config)# no interface 1-6 monitor
Aruba-2930F-24G-4SFPP(config)# show monitor
There are no Remote Mirroring endpoints currently assigned.

Network Monitoring

Sessions Status Type Sources Mirror-Policy
-------- ----------------- ----- ------- -------------
1 active port 1 No
2 not defined
3 not defined
4 not defined

Aruba-2930F-24G-4SFPP(config)#

Removing the mirror session will remove also the monitor command from any source interface.
Here for example port 7 still has the monitor command in its configuration

Aruba-2930F-24G-4SFPP(config)# show run int 7

Running configuration:

interface 7
monitor all both mirror 1
untagged vlan 1
exit

Now I am removing the mirror 1 and after that the monitor command was also removed from the monitored interface 7.

Aruba-2930F-24G-4SFPP(config)# no mirror 1
Aruba-2930F-24G-4SFPP(config)# show run int 7

Running configuration:

interface 7
untagged vlan 1
exit


Hope this helps!



------------------------------
Emil Gogushev
------------------------------

Original Message:
Sent: Feb 08, 2022 03:41 AM
From: Barbera James
Subject: 2930F Port Mirroring

Thanks for your fast reply Emil!

Some questions about that:
· If I exclude 1/8, it should not be interface 1/1-1/7,1/9-1/48,2/1-2/48 monitor all both mirror 1 ??
· Some of that ports are connected but don't have traffic, anyway that bottle neck could affect to the other ports peformance?
· And finally, how can I delete that mirror if I have any problem or I need to change the config.

Lots of thanks in advance!

------------------------------
Barbera James
------------------------------


Original Message:
Sent: Feb 08, 2022 02:19 AM
From: Emil Gogushev
Subject: 2930F Port Mirroring

Hello

Management and Configuration Guide, page 389, section Local Mirroring destination on the local switch

https://support.hpe.com/hpesc/public/docDisplay?docId=a00091307en_us&docLocale=en_US

For your scenario it should look like this

access2# conf
access2(config)# mirror 1 port 1/8
access2(config)#
access2(config)# interface 1/1-1/8,1/9-1/48,2/1-2/48 monitor all both mirror 1

Keep in mind that the mirror port 1/8 cannot be in the list of monitored port.
Instead both directions you can monitor only incoming or outgoint traffic of the monitored ports.
access2(config)# interface 1/-1/8,1/9-1/48,2/1-2/48 monitor all ?
in Monitor all inbound traffic
out Monitor all outbound traffic
both Monitor all inbound and outbound traffic

Mirroring all traffic of 94 productive ports to a single mirror port can create a bottle neck. The volume of mirrored traffic of the ports can be at times too high for a single mirror port to handle and some traffic will be dropped.


------------------------------
Emil Gogushev

Thank you for the detailed explanation and for your time, you have been of great help to me, I am going to run the tests, thank you very much!

------------------------------
Barbera James
------------------------------

Original Message:
Sent: Feb 08, 2022 04:13 AM
From: Emil Gogushev
Subject: 2930F Port Mirroring

Hello, 

· If I exclude 1/8, it should not be interface 1/1-1/7,1/9-1/48,2/1-2/48 monitor all both mirror 1 ??

The same port cannot be a destination port of the mirror session (something you configure with "mirror 1 port 1/8") and also be monitored port that means a source of the mirror session. That's why we need to exclude port 1/8 from the list of the monitored ports.  The CLI will give you an error if not excluded. Here for example I am configuring 1/8 as mirror destination and trying also the configure the same port as mirror source (monitored)

Aruba-2930F-24G-4SFPP(config)# mirror 1 port 8
Aruba-2930F-24G-4SFPP(config)# interface 8 monitor all both mirror 1
Monitor port 8 can not be a mirror source port.

The line "interface 1/1-1/7,1/9-1/48,2/1-2/48 monitor all both mirror 1 " is correct. It specifies the interfaces which should be monitored (mirror sources), for stack member 1 this are  1/1 until 1/7, and 1/9 until 1/48. Port 1/8 is not in any of this ranges so it is excluded.



· Some of that ports are connected but don't have traffic, anyway that bottle neck could affect to the other ports performance?
The performance of the other ports won't be affected. But the mirroring will be affected because the network analyzer or IDS/IPS connected to the mirroring destination port 1/8 wont be receiving all the frames mirrored from the rest of the ports.

· And finally, how can I delete that mirror if I have any problem or I need to change the config.
Any command can be undone with "no" in front of it.

Here I am configuring a mirror session nr 1 with destination port 8 and source ports 1 to 7.

Aruba-2930F-24G-4SFPP(config)# mirror 1 port 8
Aruba-2930F-24G-4SFPP(config)# int 1-7 monitor all both mirror 1

The command show monitor is showing you the current status of the mirror session. Note that 7 sources are listed.

Aruba-2930F-24G-4SFPP(config)# show monitor
There are no Remote Mirroring endpoints currently assigned.

Network Monitoring

Sessions Status Type Sources Mirror-Policy
-------- ----------------- ----- ------- -------------
1 active port 7 No
2 not defined
3 not defined
4 not defined

If I want to remove ports 1 to 6 as mirror sources and leave only port 7 I enter the following command. Note that the sources are just 1.

ruba-2930F-24G-4SFPP(config)# no interface 1-6 monitor
Aruba-2930F-24G-4SFPP(config)# show monitor
There are no Remote Mirroring endpoints currently assigned.

Network Monitoring

Sessions Status Type Sources Mirror-Policy
-------- ----------------- ----- ------- -------------
1 active port 1 No
2 not defined
3 not defined
4 not defined

Aruba-2930F-24G-4SFPP(config)#

Removing the mirror session will remove also the monitor command from any source interface.
Here for example port 7 still has the monitor command in its configuration

Aruba-2930F-24G-4SFPP(config)# show run int 7

Running configuration:

interface 7
monitor all both mirror 1
untagged vlan 1
exit

Now I am removing the mirror 1 and after that the monitor command was also removed from the monitored interface 7.

Aruba-2930F-24G-4SFPP(config)# no mirror 1
Aruba-2930F-24G-4SFPP(config)# show run int 7

Running configuration:

interface 7
untagged vlan 1
exit


Hope this helps!



------------------------------
Emil Gogushev
------------------------------


Original Message:
Sent: Feb 08, 2022 03:41 AM
From: Barbera James
Subject: 2930F Port Mirroring

Thanks for your fast reply Emil!

Some questions about that:
· If I exclude 1/8, it should not be interface 1/1-1/7,1/9-1/48,2/1-2/48 monitor all both mirror 1 ??
· Some of that ports are connected but don't have traffic, anyway that bottle neck could affect to the other ports peformance?
· And finally, how can I delete that mirror if I have any problem or I need to change the config.

Lots of thanks in advance!

------------------------------
Barbera James


Original Message:
Sent: Feb 08, 2022 02:19 AM
From: Emil Gogushev
Subject: 2930F Port Mirroring

Hello

Management and Configuration Guide, page 389, section Local Mirroring destination on the local switch

https://support.hpe.com/hpesc/public/docDisplay?docId=a00091307en_us&docLocale=en_US

For your scenario it should look like this

access2# conf
access2(config)# mirror 1 port 1/8
access2(config)#
access2(config)# interface 1/1-1/8,1/9-1/48,2/1-2/48 monitor all both mirror 1

Keep in mind that the mirror port 1/8 cannot be in the list of monitored port.
Instead both directions you can monitor only incoming or outgoint traffic of the monitored ports.
access2(config)# interface 1/-1/8,1/9-1/48,2/1-2/48 monitor all ?
in Monitor all inbound traffic
out Monitor all outbound traffic
both Monitor all inbound and outbound traffic

Mirroring all traffic of 94 productive ports to a single mirror port can create a bottle neck. The volume of mirrored traffic of the ports can be at times too high for a single mirror port to handle and some traffic will be dropped.


------------------------------
Emil Gogushev