ERSPAN Installation: Difference between revisions

From Allegro Network Multimeter Manual
Jump to navigation Jump to search
Access restrictions were established for this page. If you see this message, you have no access to this page.
(Created page with "This section describes the '''ERSPAN installation''' for the Allegro Network Multimeter. '''ERSPAN''' is the abbreviation for ''Encapsulated Remote Switch Port Analyzer''. It...")
 
(behaviour of IPv6 endpoint addresses)
 
(15 intermediate revisions by 6 users not shown)
Line 1: Line 1:
This section describes the '''ERSPAN installation''' for the Allegro Network Multimeter. '''ERSPAN''' is the abbreviation for ''Encapsulated Remote Switch Port Analyzer''. It is switch feature that encapsulates traffic into an IP/GRE tunnel.
This section describes the '''ERSPAN installation''' for the Allegro Network Multimeter to receive ERSPAN packets. '''ERSPAN''' is the abbreviation for ''Encapsulated Remote Switch Port Analyzer''. It is a Switch feature that encapsulates traffic into an IP/GRE tunnel.


== General ==
== General ==


=== What is the '''ERSPAN''' mode ===
=== What is the '''ERSPAN''' mode? ===


The Allegro Network Multimeter works in the '''mirror port mode''' as a traffic receiving device that . It will '''NOT''' send any traffic on the measurement Ethernet ports.
'''ERSPAN''' is an advanced Switch feature that encapsulates mirrored traffic into an IP and GRE packet. The full method is described in the RFC draft [https://tools.ietf.org/html/draft-foschiano-erspan-03 https://tools.ietf.org/html/draft-foschiano-erspan-03].


=== How should the '''ERSPAN''' mode be used ===
The advantage of the '''ERSPAN''' mode is that it can be routed via IP and the ERSPAN generator can be at a different location than the Allegro Network Multimeter. This allows very simple captures of a low-bandwidth remote device.


The '''ERSPAN''' quality depends on the switch performance and the bandwidth and latency between the switch and the Allegro.
=== How should the '''ERSPAN''' mode be used? ===


The data plane ports of the Allegro should be connected in the '''mirror port mode''' to one or multiple mirror ports on a switch. The management port of the Allegro shall be connected to a regular switch port or to the out-of-band management switch.
'''ERSPAN''' quality depends on the Switch performance and the bandwidth and latency between the Switch and the Allegro Network Multimeter. It will also add substantial load to the IP networks and can generate a packet storm when the ERSPAN packets are mirrored again into the ERSPAN tunnel.


See [[#Limitations]] for more details.
See [[#Limitations|Limitations]] for more details.


=== Where can I configure the '''Mirror Port Mode''' ===
=== How can I configure the '''ERSPAN''' mode? ===


Please refer to you switch manual how to set up a switch port as mirror port.
Please refer to your Switch manual how to set up a Switch ERSPAN channel. Please note that the Allegro Network Multimeter can also send '''ERSPAN''' traffic.


The '''Mirror Port Mode''' for the Allegro can be configured at '''Settings''' → '''Global Settings''' → '''Packet processing mode'''. The Interfaces can be configured to '''Bridge Mode''' or '''Sink Mode'''. The '''Sink Mode''' will disable the packet forwarding and sending on the Ethernet ports. Please switch to '''Sink Mode''' and save the settings at the bottom of the page
The '''ERSPAN''' mode can be configured at '''Settings''' → '''Global settings''' → '''Generic settings''' → '''Endpoint mode'''.  
[[File:Sink mode.png|800px]]
[[File:L3 tunnel mode.png|1000px]]


== Data Plane Ports of Allegro Network Multimeters ==
You can enable the ERSPAN mode in parallel to the [[In-Line installation]] or [[Mirror Port, Tap and Packet Broker Installation]] for one or multiple interfaces. Please be aware that ERSPAN cannot work in parallel with the Bridge mode for such an interface. The Bridge mode will be disabled for this interface pair when '''ERSPAN''' is enabled for one interface.


=== Devices with built-in Network Ports ===
The '''ERSPAN''' mode works on all of the Allegro Network Multimeter interfaces including the Virtual Edition.


The '''Allegro 200, 500, 1000, 1200, 3000 and 3200''' have built-in physical network ports.
For each interface, both an IPv4 and an IPv6 address can be configured. It is possible for both addresses to be active at the same time. It is also possible to only configure one of the addresses and leave the other field empty, in which case the '''ERSPAN''' mode will only apply to the configured address. If the IPv4 address is configured, the interface will respond to ARP requests for the IPv4 address. If the IPv6 address is configured, the interface will respond to Neighbor Solicitation messages for the IPv6 address.  


{| class="wikitable"
Once the '''ERSPAN''' mode is activated, the ERSPAN interface responds to '''ICMP/ICMPv6 Ping''' messages. Once ERSPAN is configured, you should be able to send a ping to the IP address(es).
|Device||Picture||Number of Monitoring Ports||Remarks
|-
|'''Allegro 200'''||[[File:Allegro-200 back cut.jpg|400px]]||2||
|-
|'''Allegro 500'''||[[File:Allegro-500 back cut.jpg|400px]]<br/>[[File:Allegro-500 front cut.jpg|400px]]||4||
|-
|'''Allegro 1000'''<br/>'''Allegro 3000'''||[[File:Allegro-1000 front cut.jpg|400px]]||7||Can be extended by [[#Devices with port extension cards| extension cards]].
|-
|'''Allegro 1200'''<br/>'''Allegro 3200'''||[[File:Allegro-1200-front cut.jpg|400px]]||7||Can be extended by [[#Devices with port extension cards| extension cards]].
|-
|'''Allegro x300'''<br/>'''Allegro x500'''||||none||The Allegro x300 and x500 series do not have built-in network ports, see section [[#Devices with port extension cards| extension cards]] below.
|}


=== Devices with port extension cards ===
=== Behaviour of the '''ERSPAN''' mode ===


All Allegros with network card extension slots support the '''Mirror Port Mode'''. All extension cards have either '''2''' or '''4''' network ports.
The behaviour for all packets on the '''ERSPAN''' interfaces is:


=== Bypass extension cards ===
* reply to ARP requests (if the IPv4 address is configured)
* reply to Neighbor Solicitation messages (if the IPv6 address is configured)
* reply to Ping messages (for all configured addresses)
* decapsulate all ERSPAN packets and forward them to the packet analytics
* discard all other packets
* the VLAN tag which is part of the ERSPAN header will be used as outer VLAN tag for packet analysis and Virtual Link Group filtering (>= version 4.4).


The bypass cards for the Allegro Network Multimeter deliver a fail-over when the software bypass is not active in '''Bridge Mode''' ( see [[In-Line Installation]] for more details ). The bypass is deactivated when the When the '''Mirror Port Mode / Sink Mode''' is active.
Be aware that mirrored packets without an ERSPAN header are dropped.


== Grouping of multiple Links ( Trunk vs. separate links ) ==
The ERSPAN header will be decapsulated for the analytics. The Allegro Network Multimeter analyzes the inner packet and ignores the outer ERSPAN header. The Packet Ring Buffer and Pcap export stores the full packets including the ERSPAN header.


By default, the Allegro processes all incoming traffic as one big pipe and it does not use the port as an criteria to separate links. If you have connected separate links at the Allegro, please use the virtual link grouping feature to specify which ports belong together.


This feature can also be used to forward multiple links with a packet broker to one Allegro port with VLANs as a separation.
=== Configuration of an Allegro as an '''ERSPAN''' sender ===
 
The Allegro Network Multimeter allows you to send '''ERSPAN''' packets via  the management interface  over a switched and routed network like a pcap capture. Allegro recommend you use the '''ERSPAN''' sending feature only via the LAN interface and not with the Wi-Fi interface. Please see [#Limitations] for more details.
Please make sure that the sending Allegro MTU size is big enough to send the whole packet including the '''ERSPAN''' header. To configure the Allegro Network Multimeter as an '''ERSPAN''' sender, increase the MTU size on the management interface AND on all Switches between the sending and receiving Allegro Network Multimeter. This can be done at '''Settings''' → '''Management settings''' → '''LAN management interface'''.
 
[[File:Lan mtu settings.png|900px]]
 
Once this is configured, you can initiate a '''live''' capture with or without filters with the capture button. Please select the ERSPAN as the capture type and fill the receiving IP address.
 
[[File:Erspan capture dialog.png|400px]]
 
This can be done also using Back-In-Time. Please use the real-time replay with factor 1.0 to replay with the same packet timing for the receiving Allegro Network Multimeter. See [[#Limitations|Limitations]] for more details.


== Limitations ==
== Limitations ==


=== Switch Limitations ===
=== ERSPAN protocol version ===
 
The Allegro Network Multimeter supports ERSPAN version II and III as described in the RFC draft [https://tools.ietf.org/html/draft-foschiano-erspan-03 https://tools.ietf.org/html/draft-foschiano-erspan-03].
 
=== Fragmentation ===
 
ERSPAN is supported for non-fragmented ERSPAN packets. Please make sure that the link between the Switch and the Allegro Network Multimeter supports a higher MTU than the monitored link. We recommend to use jumbo frames with 9000 bytes to forward packets.
 
=== Timestamping ===
 
The Allegro Network Multimeter does '''NOT''' use the timestamp of the ERSPAN receiver since there is only one real-time source for the Allegro Network Multimeter.
 
=== Back-In-Time support ===


Please be aware that the Allegro Network Multimeter can only analyze packets that have been forwarded by the switch port. Please also be aware that the exact packet timing and ordering depends on the switch implementation. Allegro recommends the installation of a TAP to prevent any switch side effects.
Please note that the Back-In-Time support requires that the storage is fast enough to extract the packets at the configured speed. A replay with factor 1.0 should work as most Ring Buffers can read at the same speed as they write data. Please stop or pause the Ring Buffer in this case to allow high speed reads. Higher factors work very well as long as the capture rate is lower than the replay rate.
If the storage is not fast enough, the replay will slow down to the storage speed. If you use the Back-In-Time mode without any speed limitation, it will be limited by the storage and the interface link speed.

Latest revision as of 16:22, 26 February 2025

This section describes the ERSPAN installation for the Allegro Network Multimeter to receive ERSPAN packets. ERSPAN is the abbreviation for Encapsulated Remote Switch Port Analyzer. It is a Switch feature that encapsulates traffic into an IP/GRE tunnel.

General

What is the ERSPAN mode?

ERSPAN is an advanced Switch feature that encapsulates mirrored traffic into an IP and GRE packet. The full method is described in the RFC draft https://tools.ietf.org/html/draft-foschiano-erspan-03.

The advantage of the ERSPAN mode is that it can be routed via IP and the ERSPAN generator can be at a different location than the Allegro Network Multimeter. This allows very simple captures of a low-bandwidth remote device.

How should the ERSPAN mode be used?

ERSPAN quality depends on the Switch performance and the bandwidth and latency between the Switch and the Allegro Network Multimeter. It will also add substantial load to the IP networks and can generate a packet storm when the ERSPAN packets are mirrored again into the ERSPAN tunnel.

See Limitations for more details.

How can I configure the ERSPAN mode?

Please refer to your Switch manual how to set up a Switch ERSPAN channel. Please note that the Allegro Network Multimeter can also send ERSPAN traffic.

The ERSPAN mode can be configured at Settings → Global settings → Generic settings → Endpoint mode. L3 tunnel mode.png

You can enable the ERSPAN mode in parallel to the In-Line installation or Mirror Port, Tap and Packet Broker Installation for one or multiple interfaces. Please be aware that ERSPAN cannot work in parallel with the Bridge mode for such an interface. The Bridge mode will be disabled for this interface pair when ERSPAN is enabled for one interface.

The ERSPAN mode works on all of the Allegro Network Multimeter interfaces including the Virtual Edition.

For each interface, both an IPv4 and an IPv6 address can be configured. It is possible for both addresses to be active at the same time. It is also possible to only configure one of the addresses and leave the other field empty, in which case the ERSPAN mode will only apply to the configured address. If the IPv4 address is configured, the interface will respond to ARP requests for the IPv4 address. If the IPv6 address is configured, the interface will respond to Neighbor Solicitation messages for the IPv6 address.

Once the ERSPAN mode is activated, the ERSPAN interface responds to ICMP/ICMPv6 Ping messages. Once ERSPAN is configured, you should be able to send a ping to the IP address(es).

Behaviour of the ERSPAN mode

The behaviour for all packets on the ERSPAN interfaces is:

  • reply to ARP requests (if the IPv4 address is configured)
  • reply to Neighbor Solicitation messages (if the IPv6 address is configured)
  • reply to Ping messages (for all configured addresses)
  • decapsulate all ERSPAN packets and forward them to the packet analytics
  • discard all other packets
  • the VLAN tag which is part of the ERSPAN header will be used as outer VLAN tag for packet analysis and Virtual Link Group filtering (>= version 4.4).

Be aware that mirrored packets without an ERSPAN header are dropped.

The ERSPAN header will be decapsulated for the analytics. The Allegro Network Multimeter analyzes the inner packet and ignores the outer ERSPAN header. The Packet Ring Buffer and Pcap export stores the full packets including the ERSPAN header.


Configuration of an Allegro as an ERSPAN sender

The Allegro Network Multimeter allows you to send ERSPAN packets via the management interface over a switched and routed network like a pcap capture. Allegro recommend you use the ERSPAN sending feature only via the LAN interface and not with the Wi-Fi interface. Please see [#Limitations] for more details. Please make sure that the sending Allegro MTU size is big enough to send the whole packet including the ERSPAN header. To configure the Allegro Network Multimeter as an ERSPAN sender, increase the MTU size on the management interface AND on all Switches between the sending and receiving Allegro Network Multimeter. This can be done at Settings → Management settings → LAN management interface.

Lan mtu settings.png

Once this is configured, you can initiate a live capture with or without filters with the capture button. Please select the ERSPAN as the capture type and fill the receiving IP address.

Erspan capture dialog.png

This can be done also using Back-In-Time. Please use the real-time replay with factor 1.0 to replay with the same packet timing for the receiving Allegro Network Multimeter. See Limitations for more details.

Limitations

ERSPAN protocol version

The Allegro Network Multimeter supports ERSPAN version II and III as described in the RFC draft https://tools.ietf.org/html/draft-foschiano-erspan-03.

Fragmentation

ERSPAN is supported for non-fragmented ERSPAN packets. Please make sure that the link between the Switch and the Allegro Network Multimeter supports a higher MTU than the monitored link. We recommend to use jumbo frames with 9000 bytes to forward packets.

Timestamping

The Allegro Network Multimeter does NOT use the timestamp of the ERSPAN receiver since there is only one real-time source for the Allegro Network Multimeter.

Back-In-Time support

Please note that the Back-In-Time support requires that the storage is fast enough to extract the packets at the configured speed. A replay with factor 1.0 should work as most Ring Buffers can read at the same speed as they write data. Please stop or pause the Ring Buffer in this case to allow high speed reads. Higher factors work very well as long as the capture rate is lower than the replay rate. If the storage is not fast enough, the replay will slow down to the storage speed. If you use the Back-In-Time mode without any speed limitation, it will be limited by the storage and the interface link speed.

Retrieved from "https://allegro-packets.com/wiki/index.php?title=ERSPAN_Installation&oldid=4984"