Ethernet Switching
Highlighted
Ethernet Switching

Analyzer output to multiple interfaces issue

‎05-14-2019 08:37 AM

Hello everybody,

 

  I configured an EX4300 switch with an analyzer session whose input are packets entering a particular VLAN and sending those packet to multiple output interfaces following this known workaround: Configuring Multiple Port Mirroring Sessions on an EX4300 Switch

 

It is almost working, since I can see mirrored traffic on the "hub" interfaces, but is far less traffic compared to the traffic exiting the analyzer output interface. Let's say, on the output interface I see almost 900 Mbps, while on the "hub" interfaces where my analyzer devices are attached I see only 50 or 60 Mbps.

 

This is how I configured the analyzer:

 

show configuration forwarding-options analyzer 
MIRROR {
    input {
        ingress {
            vlan GuestVlan;
        }
    }
    output {
        interface ge-0/0/40.0;
    }
}
show configuration interfaces ge-0/0/40 
description "MIRROR OUTPUT INTERFACE";
unit 0 {
    family ethernet-switching {
        storm-control default;
    }
}

show configuration interfaces ge-0/0/41    
description "MONITORING LOOP INTERFACE";
unit 0 {
    family ethernet-switching {
        interface-mode access;
        vlan {
            members MIRROR;
        }
    }
}

show configuration interfaces ge-0/0/42    
unit 0 {
    family ethernet-switching {
        interface-mode access;
        vlan {
            members MIRROR;
        }
        storm-control default;
    }
}

Interfaces from ge-0/0/41 to ge-0/0/47 belong to the MIRROR vlan and are set with the "no-mac-learning" option. The loop link is between ports ge-0/0/40 and ge-0/0/41.

 

These are the traffic statistics on the interfaces:

 

show interfaces ge-0/0/40 
...
  Input rate     : 0 bps (0 pps)
  Output rate    : 967054528 bps (202390 pps)

show interfaces ge-0/0/41    
...
  Input rate     : 959416000 bps (250525 pps)
  Output rate    : 0 bps (0 pps)

show interfaces ge-0/0/42    
...
  Input rate     : 0 bps (0 pps)
  Output rate    : 30896064 bps (8170 pps)

As you can see, on ge-0/0/42 the output rate is much lower than what is seen on ge-0/0/40.

 

Any idea? Thank you in advance!

3 REPLIES 3
Highlighted
Ethernet Switching

Re: Analyzer output to multiple interfaces issue

‎05-14-2019 09:58 AM

Hello,

If You disable MAC learning, ALL traffic becomes BUM and subjected to storm control.

Please remove storm-control from all interfaces involved in mirroring, re-test and report back.

HTH

Thx

Alex

_____________________________________________________________________

Please ask Your Juniper account team about Juniper Professional Services offerings.
Juniper PS can design, test & build the network/part of the network as per Your requirements

+++++++++++++++++++++++++++++++++++++++++++++

Accept as Solution = cool !
Accept as Solution+Kudo = You are a Star !
Highlighted
Ethernet Switching

Re: Analyzer output to multiple interfaces issue

‎05-20-2019 05:11 AM

Removed the storm-control statement from all the interfaces involved in mirroring, but nothing changed. We changed our mirroring layout inserting a third party switch.

Highlighted
Ethernet Switching

Re: Analyzer output to multiple interfaces issue

‎05-20-2019 09:30 PM

Hi Gica78R,

 

The analyzer configuration is capturing ingress traffic for "guestvlan".  Is the intention to capture "MIRROR" vlan traffic? In that case make the mirror config as "input ingress MIRROR".

 

See options for analyzer configuration here:

https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/port-mirroring-cli.html
https://www.juniper.net/documentation/en_US/junos/topics/example/port-mirroring-local-ex-series-l2.h...

 

Also, for EX4300 this configuration might need Junos 14.1X53-D10 to work:

https://apps.juniper.net/feature-explorer/feature-info.html?fKey=6341&fn=Native%20analyzer%20support

 

Hope this helps.

 

Regards,
-r.

--------------------------------------------------

If this solves your problem, please mark this post as "Accepted Solution."
Kudos are always appreciated Smiley Happy.