Description

Contrail supports mirror/duplicate traffic and sending it to an analyzer. Traffic can be mirrored on either network (network mirror) or interface (port mirror).

This article explains port mirror from an implementation perspective.

Solution

Port mirror is enabled by mirror configuration on the VM interface. No filter can be configured, so all traffic will be mirrored. The attribute that can be controlled is the direction. Ingress or engress traffic, or both could be mirrored. When traffic on a Virtual Machine Interface (VMI) is mirrored, a Juniper header is added for steering mirrored traffic to the analyzer on L3. Given analyzer address or FQ name of analyzer service instance, mirror vrouter will be able to find the NH for mirrored traffic by looking up L3 table in VRF. Mirrored traffic with Juniper header is encapsulated in MPLSoUDP/MPLSoGRE in which the MPLS label is used to identify analyzer interface. Analyzer vrouter takes the L3 packet (Juniper header + mirrored L2 frame), identifies analyzer interface, adds a L2 header (src MAC: vrouter, dst MAC: analyzer), and sends it to the analyzer.

Contrail-vrouter-agent adds a mirror entry in the vrouter and points to the nexthop to be used. The data for Juniper header is taken from the flow entry. In case of interface mirroring, the Juniper header will have a new TLV in the metadata to have interface name and use that instead of providing destination VN.

  • Mirror entry will now have flags to indicate whether to add Juniper header or not, and whether to add L2 header or not.

  • When dynamic nexthop is used, nexthop is chosen, as it is currently done and the mirror entry points to it.

  • When static nexthop is used, a new nexthop is created with the configured values and mirror entry points to it.

With respect to port mirror, there is an option to disable Juniper header. 
With Dynamic NH, the NH is found by vrouter by looking up VRF given L2/L3 address or FQ name. This mode is for supporting virtual analyzer who connects to vrouter.
With Static NH, the NH is statically configured. This mode is for supporting physical analyzer who connects to VTEP (eg. ToR).


Dynamic NH

Mirrored Packet with Juniper Header 

+-----------+-----------+---------------+----------+----------+
| MPLSoUDP/ | Analyzer  | UDP Header    | Metadata | Mirrored |
| MPLSoGRE  | IP Header | Analyser Port |          | L2 Frame |
+-----------+-----------+---------------+----------+----------+
             \__________________  ________________/
                                \/
                          Juniper Header
 

Mirrored Packet Without Juniper Header 

+-----+-------+----------+
| UDP | MPLS  | Mirrored |
|     |       | L2 Frame |
+-----+-------+----------+

 

Static NH

Static NH is used to support physical analyzer connecting to VTEP (ToR). No Juniper header will be added in this case. Mirrored L2 frame is encapsulated in VXLAN and is sent to VTEP who will flood mirror traffic within that L2 domain. The mirror flag has to be set for analyzer network to enable such flood. VNI of analyzer network and VTEP address of analyzer are required to configure static NH. VXLAN header is built based on that info. 

+-------+----------+
| VXLAN | Mirrored |
|       | L2 Frame |
+-------+----------+

Config required for:

  • Dynamic without Juniper Header - Analyzer VM MAC & Destination Mirror VN, mode- dynamic, Juniper header - False

  • Static without Juniper Header - VTEP IP , VNI(Vxlan_id), mode-static JuniperHeader -false