Wired

last person joined: yesterday 

Bring performance and reliability to your network with the Aruba Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of the ArubaOS-Switch and ArubaOS-CX devices, and find ways to improve security across your network to bring together a mobile first solution.
Expand all | Collapse all

Port Mirroring for 2930F/M

Jump to Best Answer
  • 1.  Port Mirroring for 2930F/M

    Posted Mar 21, 2019 07:20 PM

    Hi guys.

    For these switches I need to deploy port mirroring, but the "Aruba 2930F/M Management and Configuration Guide for ArubaOS-Switch" is not clear about syntax of the commands.

    It seems that this port mirroring is not implemented as traditional port mirroring where you set a session, add source ports to monitor to that session, and add a destination port (where the IDS is connected) to mirror traffic. Can I configure more than 1 local port mirroring session?. Manual only talks about "session 1", but is not clear if I can set 2, session 3, ... etc.

    Something similar happens with Remote Port mirroring. Traditionally a mirroring VLAN is used to take mirrored traffic to a remote switch where the mirroring port (IDS) is, but for these switches remote port mirroring is implemented in other way.

    Can anybody help me?

     

    Regards

     


    #2930M
    #2930M
    #2930F


  • 2.  RE: Port Mirroring for 2930F/M
    Best Answer

    Posted Mar 22, 2019 12:20 PM

    Greetings!

     

    I just took a look at the section in question, and yep, we definitely need to put better examples in there — thanks for the heads-up!

     

    Configuring port mirroring is actually fairly simple — with the correct syntax — and is deployed as you would expect.

     

    First, create the local mirror session and assign it to a port (in this case, port 23):

     

    switch(config)# mirror 1 port 23

    Then, choose one or more interfaces to monitor, the direction of traffic to be monitored (inbound, outbound, or both), and the destination mirror session:

     

    switch(config)# interface 1-4 monitor all out mirror 1

    You can configure up to 4 local mirror sessions, with one mirror destination port and any number of source ports per session (with the obvious caveat that any monitored traffic in excess of available bandwidth on the destination port will be dropped). 

     

    As for remote mirroring: ArubaOS-Switch utilizes the HP Encapsulated Remote Mirroring (HP ERM) protocol, which is intended to send mirrored packets to another ArubaOS-Switch or ProVision OS device for decapsulation and forwarding to the capture station. However, Wireshark includes a plugin for decoding HP ERM protocol packets, so instead of setting the remote mirroring destination as another switch, you can set it to a system running Wireshark instead.

     

    To configure a remote mirror session, you will need to specify the source IP address, UDP encapsulation port (used to receive and/or decapsulate mirrored traffic at the destination), and remote station IP address:

     

    switch(config)# mirror 2 remote ip 10.100.0.254 9999 10.30.1.45

    This sends mirrored traffic from the switch IP address 10.100.0.254 to the remote mirroring station at 10.30.1.45 using UDP port 9999.

     

    If using Wireshark to capture the mirrored traffic, you will need to filter incoming traffic by the switch IP address (ip.src== 10.100.0.254) and then configure the decoder — from the Analyze menu, choose Decode As..., then click the + button in the bottom left. For the Field, choose UDP port and set the Value to 9999. Leave Type and Default alone, and under Current, choose HP_ERM. Click OK, and after Wireshark reprocesses any packets already captured, you should now see the properly decapsulated traffic.

     

    If the HP_ERM protocol does not appear in the list as described above, you may need to manually enable it. Open Analyze -> Enabled Protocols..., and type HP_ERM into the search bar at the bottom. If the box is unchecked, check the box to enable the protocol and then click OK. (You may need to restart Wireshark for this change to take effect.)

     

    Let us know if you run into any issues while configuring mirroring from these instructions.



  • 3.  RE: Port Mirroring for 2930F/M

    Posted Mar 24, 2019 07:44 PM

    Hi Matthew,

    Thanks for the information.

    For this command:

    switch(config)# interface 1-4 monitor all out

    How does de system parses the comand?, I mean, how the system knows that the command belongs to session 1, 2, 3 or 4?

     

    About remote mirroring, how many simultaneous sessions can be created in a 2930M switch?, also 4?
    Can I use the 3810M Management and Configuration Guide, as a reference for the sintaxis?

    Regards

     

     

     

     

     



  • 4.  RE: Port Mirroring for 2930F/M

    Posted Mar 25, 2019 08:42 AM

    Note: I just corrected the syntax in my original post for the monitored interface configuration — I accidentally left off the destination mirror session portion, as pointed out by N3tw0rk3r. D'oh!



  • 5.  RE: Port Mirroring for 2930F/M

    Posted Mar 24, 2019 10:45 PM

    After checking some 3810M manuals, I have the following information that, in my humble opinion, could clarify how Local and Remote Port mirroring is implemented for this model (I guess that this also could be applied to 2930M/F). Please feel free to correct anything wrong in this.

    -------------------------------------------------------------------

    Please see the syntax conventions used for this explanation at the end of this information.

    Local Port Mirroring:

    1. Create the session and assign the local mirroring port (where your IDS is connected):

    mirror session-# port exit-port-# [name name-str]

     

    Notes:

    session-#: value from 1 to 4

     

    1. Assign the monitored ports, vlans or mac addresses to any of the created local port mirroring sessions:

    interface {port | trunk | mesh} monitor all {in | out | both} mirror {session-# | name-str} [{session-# | name-str}] [{session-# | name-str}] | [{session-# | name-str}] [no-tag-added]

     

    vlan vid-# monitor all {in | out | both} mirror {session-# | name-str} [{session-# | name-str}] [{session-# | name-str}] [{session-# | name-str}]

     

    monitor mac mac-addr [src | dest | both] mirror {session-# | name-str} [{session-# | name-str}] [{session-# | name-str}] [{session-# | name-str}]

     

    Remote Port Mirroring:

    You have to configure the source switch and you also have to configure the destination switch.

    Source Switch:

    1. Create the session, assign the source ip address and source udp port used in the source switch and assign the destination ip address of the remote switch:

    mirror session-# [name name-str] remote ip src-ip src-udp-port dst-ip [truncation]

    Notes:

    session-#: value from 1 to 4

     

    1. Assign the monitored ports, vlans or mac addresses to any of the created remote port mirroring sessions:

    interface {port | trunk | mesh} monitor all {in | out | both} mirror {session-# | name-str} [{session-# | name-str}] [{session-# | name-str}] | [{session-# | name-str}] [no-tag-added]

     

    vlan vid-# monitor all {in | out | both} mirror {session-# | name-str} [{session-# | name-str}] [{session-# | name-str}] [{session-# | name-str}]

     

    monitor mac mac-addr [src | dest | both] mirror {session-# | name-str} [{session-# | name-str}] [{session-# | name-str}] [{session-# | name-str}]

     

    Destination Switch:

    1. Use the same parameters (source ip address, source udp port, destination ip address) employed in the source switch configuration, and assign the mirroring port (where your IDS is connected):

    mirror endpoint ip src-ip src-udp-port dst-ip port exit-port-#

     

    References:

    Aruba 3810 / 5400R Management and Configuration Guide for ArubaOS-Switch 16.08

    https://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-a00061577en_us-2.pdf

    (See Mirroring configuration examples on page 538)

     

    Syntax conventions I am using:

    Convention

    Description

    boldface

    Boldface text indicates commands and keywords that you enter literally as shown.

    italics

    Italic text indicates arguments for which you supply values.

    [x]

    Square brackets enclose an optional element (keyword or argument).

    |

    A vertical line indicates a choice within an optional or required set of keywords or arguments.

    [x | y]

    Square brackets enclosing keywords or arguments separated by a vertical line indicate an optional choice.

    {x | y}

    Braces enclosing keywords or arguments separated by a vertical line indicate a required choice.

    [x {y | z}]

    Braces and a vertical line within square brackets indicate a required choice within an optional element.

    Regards



  • 6.  RE: Port Mirroring for 2930F/M

    Posted Mar 24, 2019 10:48 PM

    Thanks to Matthew Fern for the information about the Local and Remote Mirroring commands !!!!



  • 7.  RE: Port Mirroring for 2930F/M

    Posted May 11, 2020 11:47 AM

    Hello everybody

    I have configured a mirror port for 3 interface but when performing the test it only throws the salinte traffic at me

     

    MW-SwitchCore(config)# mirror 1 port 11
    MW-SwitchCore(config)# interface 28-27,Trk1  monitor all both  mirror 1