Wired Intelligent Edge

Hi all,

Please help me on configuration Port Mirroring as the network above.

Switch 2930F has VLAN1 and VLAN2

Best regards,

Anyone can help me, please!

I don't know how to configure on the 2930F.

Best Regards,

switch(config)# mirror 1 port 23

switch(config)# interface 1-4 monitor all out mirror 1

switch(config)# mirror 2 remote ip 10.100.0.254 9999 10.30.1.45
for reference find below

https://community.arubanetworks.com/t5/Wired-Intelligent-Edge-Campus/Mirror-Port-2930F-Switch/m-p/493761#M4786

https://community.arubanetworks.com/t5/Wired-Intelligent-Edge-Campus/Port-Mirroring-for-2930F-M/td-p/520415

https://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-a00055700en_us-2.pdf

https://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-a00061577en_us-2.pdf

Hi Sureshreddy,

Thank you for your reply. Could you please explain more about the IP Source, IP Destination addresses?

Regards,

Greetings!

The source IP address for the remote mirroring command is an IP address on the 2930F that will be used as the source interface for sending mirrored traffic to the destination IP, which is the traffic analyzer server in your diagram. The destination TCP port is used at the traffic analyzer/capture station to capture the encapsulated remote mirroring packets from the 2930F for decapsulation (per the instructions in this post). 

Basically, this is a method to send mirrored traffic to a remote switch or capture station using Layer 3 routing, rather than the conventional method of mirroring traffic to a local switch port. The traffic is encapsulated using the HP Encapsulated Remote Mirroring (HP ERM) protocol, which can be decapsulated by either another Aruba or HP ProCurve switch or by Wireshark using the built-in HP ERM dissector.

Thank you Matthew,

I use Security Onion as Network Analyzer with no IP address on sniffing NIC. So I don't know the destination IP.

Best regards,