Description

This article discusses some common mistakes that are made while configuring port mirroring in Contrail post R3.x, the effects of the misconfiguration, and the steps that can be taken to avoid these issues.

 

Symptoms

  1. The mirror next hop may not be created on the compute node where the Virtual Machine Interface (VMI) resides. The mirror --dump command does not show an entry. 

root@compute1:~# mirror --dump
Mirror Table

Flags:D=Dynamic Mirroring 

Index    NextHop    Flags    VNI
------------------------------------------------
 

  1. A mirror NH exists but is invalid, and therefore leads to traffic drop. 

### Juniper header Enabled ###

root@compute1:~# mirror --dump
Mirror Table

Flags:D=Dynamic Mirroring 

Index    NextHop    Flags    VNI
------------------------------------------------
    0         46       D          0

root@compute1:~# nh --get 46
Id:46         Type:Tunnel         Fmly: AF_INET  Rid:0  Ref_cnt:2          Vrf:-1
              Flags:Valid, Udp, Copy SIP, 
              Oif:0 Len:14 Flags Valid, Udp, Copy SIP,  Data:00 00 00 00 00 00 52 54 00 1c f4 ce 08 00 
              Vrf:-1  Sip:10.168.5.7  Dip:10.1.0.7
              Sport:8097 Dport:8099


### Juniper Header Disabled ### 

root@compute1:~# mirror --dump
Mirror Table

Flags:D=Dynamic Mirroring 

Index    NextHop    Flags    VNI
------------------------------------------------
    0          1                  0

root@compute1:~# nh --get 1
Id:1          Type:Drop           Fmly: AF_INET  Rid:0  Ref_cnt:1006       Vrf:0
              Flags:Valid,
 

  1. The mirror metadata is missing on the VMI.

 

Solution

The above symptoms are the result of some of the common mistakes that are made while configuring port mirroring on a VMI, including the following:

  1. Missing Analyzer MAC address

  2. Missing or mismatched Analyzer VM name

  3. Missing or mismatched destination VN

  4. Missing Analyzer IP address

 

To avoid the consequences of such configuration mistakes and for optimal results, use the following recommendations:

  1. Configure the Analyzer in a separate network (not in the same VN as the VMI traffic that is being mirrored).

  2. Disable the policy on the Analyzer VM to make sure that it accepts all the traffic that is mirrored (Configure > Networking > Edit the VMI > Advanced Options > Select the Disable Policy check box).

  3. If dynamic NH has been selected with Juniper Header Disabled, make sure that the Analyzer VM MAC address and the Destination Mirror VRF are configured.

  4. If static NH has been selected with ​Juniper Header Disabled, make sure that the virtual tunnel endpoint (VTEP) ID and the VNI (VxLAN ID) are specified.