Configuration Guide User guide

FastIron Configuration Guide 939
53-1002494-02
VLAN-based mirroring
VLAN-based mirroring on FastIron X Series devices
WIth the new FastIron X Series of modules, the sFlow processing has been separated from the
packet mirroring functionality. This allows for support of VLAN-based mirroring on the FastIron X
Series devices. The packet processor on the FastIron X Series of modules also allows for egress
VLAN-based mirroring. In order for VLAN-based monitoring to function, the FastIron X Series must
have only the following SX modules installed.
The following interface modules are new to the FastIron X Series:
• SX-FI-24GPP
• SX-FI-24HF
• SX-FI-2XG
• SX-FI-8XG
• SX-FI48GPP
NOTE
Egress VLAN-based mirroring is not currently supported on the stacking platforms.
The FastIron X Series of modules are capable of monitoring 4096 VLANs. In a chassis environment,
this introduces restrictions to the number of ports that can be configured as mirror ports. Because
a single VLAN can contain 384 untagged ports (24 per slot) if that VLAN is configured for
monitoring, every device must have an identical number of corresponding analyzer ports. However,
the egress mirror-port and ingress mirror-port do not have to be the same. You can use two
separate ports.
This introduces restrictions on port-based mirroring coexisting with VLAN-based mirroring.
Port-based mirroring allows for multiple ports to be configured as mirror-ports. However, once a
particular port belonging to a particular device is configured for monitoring to a specific mirror-port,
no other mirror-port can be used to monitor any other port on that device. This restriction has been
extended to VLAN-based mirroring, with one caveat: only one mirror-port in either direction at a
time can exist within the system. Refer to “About port regions” on page 556 for a list of valid port
ranges on these devices.
Restrictions and capabilities of VLAN-based mirroring
The following is a list of restrictions and capabilities:
• Only the modules that support VLAN-based mirroring should be installed.
• There can be only one input or output mirror-port configured in the system at a time.
• The amount of traffic mirrored is limited by the bandwidth of the mirror-port.
• The maximum amount of egress traffic that can be mirrored is further limited by the bandwidth
of the loopback port, which is 10 Gbps.
• The monitored VLAN must be created in hardware.
• An ingress or egress mirror-port must be configured when monitoring the ingress or egress
VLAN traffic.
• A maximum of 4096 VLANs can be monitored at a time.
• A VLAN can be monitored for ingress and egress traffic concurrently.
• Port mirroring can be configured concurrently with VLAN-based mirroring, but only one
mirror-port can be used for both.