Wired Intelligent Edge

last person joined: yesterday 

Bring performance and reliability to your network with the HPE Aruba Networking Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of your switching devices, and find ways to improve security across your network to bring together a mobile-first solution
Back to discussions
Expand all | Collapse all

Port Mirroring between 5510HI and 2930F

This thread has been viewed 5 times

  • 1.  Port Mirroring between 5510HI and 2930F

    Posted Jun 03, 2019 05:06 AM

    5510HI-2930F-Mirroring.jpg

    Hi all,

     

    Please help me on configuration Port Mirroring as the network above.

    Switch 2930F has VLAN1 and VLAN2

    Best regards,



  • 2.  RE: Port Mirroring between 5510HI and 2930F

    Posted Jun 04, 2019 12:05 AM

    Anyone can help me, please!

    I don't know how to configure on the 2930F.

    Best Regards,



  • 3.  RE: Port Mirroring between 5510HI and 2930F



  • 4.  RE: Port Mirroring between 5510HI and 2930F

    Posted Jun 04, 2019 03:26 AM

    Hi Sureshreddy,

    Thank you for your reply. Could you please explain more about the IP Source, IP Destination addresses?

    Regards,



  • 5.  RE: Port Mirroring between 5510HI and 2930F

    EMPLOYEE
    Posted Jun 04, 2019 09:47 AM

    Greetings!

     

    The source IP address for the remote mirroring command is an IP address on the 2930F that will be used as the source interface for sending mirrored traffic to the destination IP, which is the traffic analyzer server in your diagram. The destination TCP port is used at the traffic analyzer/capture station to capture the encapsulated remote mirroring packets from the 2930F for decapsulation (per the instructions in this post). 

     

    Basically, this is a method to send mirrored traffic to a remote switch or capture station using Layer 3 routing, rather than the conventional method of mirroring traffic to a local switch port. The traffic is encapsulated using the HP Encapsulated Remote Mirroring (HP ERM) protocol, which can be decapsulated by either another Aruba or HP ProCurve switch or by Wireshark using the built-in HP ERM dissector.



  • 6.  RE: Port Mirroring between 5510HI and 2930F

    Posted Jun 05, 2019 03:56 AM

    Thank you Matthew,

     

    I use Security Onion as Network Analyzer with no IP address on sniffing NIC. So I don't know the destination IP.

     

    Best regards,