Wired Intelligent Edge

 View Only
last person joined: 3 days ago 

Bring performance and reliability to your network with the HPE Aruba Networking Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of your switching devices, and find ways to improve security across your network to bring together a mobile-first solution
Back to discussions
Expand all | Collapse all

Mirroring in an 8325 VSX Topology

This thread has been viewed 16 times

  • 1.  Mirroring in an 8325 VSX Topology

    Posted Jul 10, 2023 04:51 PM

    I have a vsx pair of 8325 switches that I want to set up mirroring on for all of my MC-LAGS.  I have a security appliance that the mirrored traffic will be sent to.  For the destination, would I set up a single 10G interface going to the appliance on just the primary switch in the mirror session and then specify all of the MC-LAGs as the source interface?  Does the same mirror session and source/destinations need to be set up on the secondary switch as well?  If so, do I need to have a MC-LAG going to my appliance from the destination interface on each VSX paired switch? 



  • 2.  RE: Mirroring in an 8325 VSX Topology

    EMPLOYEE
    Posted Jul 12, 2023 01:35 AM

    VSX nodes work independently as regards to mgmt/control-plane.

    so one need to configure mirroring on both nodes. (I have not tested this)



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------

    Original Message


  • 3.  RE: Mirroring in an 8325 VSX Topology

    Posted Jul 12, 2023 04:42 AM

    That's how I have it set up now.  Session 1 on primary VSX switch, session 2 on secondary vsx switch with the same SFP+ interface on each switch as the the session destination.  I then have each of my downstream MC-lags as the source for each session on each switch.  Each destination interface will go to a separate SFP+ port on the security appliance.  Will test it when I go live with my network Saturday.  Thanks.


    Original Message


  • 4.  RE: Mirroring in an 8325 VSX Topology

    MVP GURU
    Posted Jul 13, 2023 04:06 AM
    Hi! ...and how your Security Appliance is dealing with two different monitoring sessions from the collected data point of view? I mean...it's absolutely a possible setup...but I'm asking because (...I'm thinking of...) isn't there the need to let the Security Appliance to "reconcile" (or just manage) ingressing packets streams "as if" they are coming from a single source instead of two...or not? ...or, probably, my assumption here is largerly erroneous.

    I'm asking because we are in the process (we are at an early stage to be honest) of evaluating the connection of a Snort based appliance to one of ours VSX Clusters.



    Original Message