Allegro Network Multimeter Manual

ERSPAN Installation: Difference between revisions

Page Discussion

ERSPAN Installation (view source)

Revision as of 09:26, 30 March 2020

762 bytes added ,  30 March 2020
no edit summary
No edit summary
No edit summary
Line 1: Line 1:
This section describes the '''ERSPAN installation''' for the Allegro Network Multimeter. '''ERSPAN''' is the abbreviation for ''Encapsulated Remote Switch Port Analyzer''. It is switch feature that encapsulates traffic into an IP/GRE tunnel.
This section describes the '''ERSPAN installation''' for the Allegro Network Multimeter to receive ERSPAN packets. '''ERSPAN''' is the abbreviation for ''Encapsulated Remote Switch Port Analyzer''. It is switch feature that encapsulates traffic into an IP/GRE tunnel.


== General ==
== General ==
Line 17: Line 17:
=== Where can I configure the '''ERSPAN''' mode ===
=== Where can I configure the '''ERSPAN''' mode ===


Please refer to you switch manual how to set up a switch ERSPAN channel.
Please refer to you switch manual how to set up a switch ERSPAN channel. Please note that the Allegro Network Multimeter can also send '''ERSPAN''' traffic.


The '''ERSPAN''' mode can be configured at '''Settings''' → '''Global Settings''' → '''Expert Settings''' → '''L3 Tunnel mode'''.  
The '''ERSPAN''' mode can be configured at '''Settings''' → '''Global Settings''' → '''Expert Settings''' → '''L3 Tunnel mode'''.  
[[File:L3 tunnel mode.png|800px]]
[[File:L3 tunnel mode.png|800px]]


You can enable the ERSPAN mode in parallel to the [[In-Line Installation]] or [[Mirror Port, TAP and Packet Broker Installation]] for one or multiple ports. Please be aware that the ERSPAN cannot work in parallel with the bridge mode for such a port.
You can enable the ERSPAN mode in parallel to the [[In-Line Installation]] or [[Mirror Port, TAP and Packet Broker Installation]] for one or multiple interfaces. Please be aware that the ERSPAN cannot work in parallel with the bridge mode for such an interface. The bridge will be disabled for this interface pair when '''ERSPAN''' is enabled for one interface.


The '''ERSPAN''' mode works on all interfaces of the Allegro Network Multimeter, including the virtual version.


Once the ERSPAN mode is activated, the interface will respond to ARP requests for the configured IP address. The '''ERSPAN''' interface responds to '''ICMP PING''' messages. Once the ERSPAN is configured, you should be able to send a ping to the IP address.


=== Behavior of the '''ERSPAN''' mode ===


The behavior for all packets on the '''ERSPAN''' interfaces is:


* reply to ARP requests
* reply to PING messages
* decapsulate all ERSPAN packets and forard them to the packet analytics
* discard all other packets


== Data Plane Ports of Allegro Network Multimeters ==
Be aware that mirrored packets without an ERSPAN header are dropped.


=== Devices with built-in Network Ports ===
The ERSPAN header will be decapsulated for the analytics. The Allegro Network Multimeter analyzes the inner packet and ignores the outer ERSPAN header. The packet ring buffer and Pcap export stores the full packets including the ERSPAN header.


The '''Allegro 200, 500, 1000, 1200, 3000 and 3200''' have built-in physical network ports.


{| class="wikitable"
=== Configuration of an Allegro as '''ERSPAN''' sender ===
|Device||Picture||Number of Monitoring Ports||Remarks
|-
|'''Allegro 200'''||[[File:Allegro-200 back cut.jpg|400px]]||2||
|-
|'''Allegro 500'''||[[File:Allegro-500 back cut.jpg|400px]]<br/>[[File:Allegro-500 front cut.jpg|400px]]||4||
|-
|'''Allegro 1000'''<br/>'''Allegro 3000'''||[[File:Allegro-1000 front cut.jpg|400px]]||7||Can be extended by [[#Devices with port extension cards| extension cards]].
|-
|'''Allegro 1200'''<br/>'''Allegro 3200'''||[[File:Allegro-1200-front cut.jpg|400px]]||7||Can be extended by [[#Devices with port extension cards| extension cards]].
|-
|'''Allegro x300'''<br/>'''Allegro x500'''||||none||The Allegro x300 and x500 series do not have built-in network ports, see section [[#Devices with port extension cards| extension cards]] below.
|}


=== Devices with port extension cards ===
The Allegro Network Multimeter allows to send '''ERSPAN''' as a switch via the management interface like a Pcap capture. Allegro recommend to use the '''ERSPAN''' sending feature only via the LAN interface and not with the Wifi interface. Please see [#Limitations] for more details.
Please make sure that the MTU size of the sending Allegro is big enough to send the whole packet including the '''ERSPAN''' header. To configure the Allegro as an '''ERSPAN''' sender, please increase the MTU on the management interface AND on all switches between the sending and receiving Allegro. This can be done at '''Settings''' → '''Management Settings''' → '''LAN Management Interface'''.


All Allegros with network card extension slots support the '''Mirror Port Mode'''. All extension cards have either '''2''' or '''4''' network ports.
[[File:Lan mtu settings.png|600px]]


=== Bypass extension cards ===
Once this is configured, you can start a '''live''' capture of a whole link, IP address on the sending Allegro. Please select the ERSPAN as capture type and fill the receiving IP address.


The bypass cards for the Allegro Network Multimeter deliver a fail-over when the software bypass is not active in '''Bridge Mode''' ( see [[In-Line Installation]] for more details ). The bypass is deactivated when the When the '''Mirror Port Mode / Sink Mode''' is active.
[[File:Erspan capture dialog.png|400px]]


== Grouping of multiple Links ( Trunk vs. separate links ) ==
This can be done also back in time. Please use realtime replay with factor 1.0 to replay with the same packet timing for the receiving Allegro. See [#Limitations] for more details.


By default, the Allegro processes all incoming traffic as one big pipe and it does not use the port as an criteria to separate links. If you have connected separate links at the Allegro, please use the virtual link grouping feature to specify which ports belong together.
== Limitations ==
 
=== ERSPAN protocol version ===
 
The Allegro Network Multimeter supports ERSPAN version II and III as described in the RFC draft [https://tools.ietf.org/html/draft-foschiano-erspan-03 https://tools.ietf.org/html/draft-foschiano-erspan-03].


This feature can also be used to forward multiple links with a packet broker to one Allegro port with VLANs as a separation.
=== Fragmentation ===


== Limitations ==
ERSPAN is supported for non-fragmented ERSPAN packets. Please make sure that the link between the switch and the Allegro supports a higher MTU than the monitored link. We recommend to use jumbo frames with 9000 bytes to forward packets.


=== Switch Limitations ===
=== Timestamping ===


Please be aware that the Allegro Network Multimeter can only analyze packets that have been forwarded by the switch port. Please also be aware that the exact packet timing and ordering depends on the switch implementation. Allegro recommends the installation of a TAP to prevent any switch side effects.
The Allegro Network Multimeter does '''NOT''' use the time stamps of the ERSPAN receiver as there is only one real-time source for the Allegro Network Multimeter.
Klaus
404

edits

Retrieved from "https://allegro-packets.com/wiki/Special:MobileDiff/649"