Contrail can be configured to mirror traffic between two virtual networks (VNs) to a specified analyzer VM instance.
This article demonstrates how to configure and verify network mirroring by using the Monitor > Debug > Packet Capture workspace on the Contrail WebUI.
Note: To configure network mirroring using a service instance, refer to KB34217 - [Contrail] Configure Network Mirroring using Service Instance [juniper.net] .
The Monitor > Debug > Packet Capture workspace on the Contrail WebUI can be used to create an analyzer and automatically spawn an analyzer VM instance by using the m1.medium flavor. But before configuring the traffic analyzer for mirroring, make sure that the analyzer image is available in the VM image list in Openstack. The image name must be "analyzer" when using this method. Also make sure that the m1.medium flavor does exist.
In this article, traffic between VN-A (10.1.0.0/24) and VN-B (10.2.0.0/24) will be mirrored. The steps to allow traffic between VN-A and VN-B is, however, out of the scope of this article. Refer to KB33730 - [Contrail] How to achieve inter-VN communication between Virtual-networks without using a network policy [juniper.net] for more information.
VN-M (10.250.0.0/24) is created to host the analyzer VM instance, which is generated via the Monitor > Debug > Packet Capture workspace.
The configurations to enable network mirroring are as follows:
Configuration steps from the Contrail GUI
Click the "+" button to create a new analyzer. Enter the following parameters and click Save :
Name of the Analyzer
Virtual Network to host the analyzer VM instance
Associate Networks
Wait for the analyzer status to be Active.
After the analyzer status is Active, select the View Analyzer option from Settings.
Network Mirror Verification
Note that the analyzer VM instance has been spawned automatically by using the m1.medium flavor.
Initiate traffic from VM-A1 (10.1.0.3) in VN-A to VM-B1 (10.2.0.3) in VN-B and examine the analyzer VM (10.250.0.3).
Observe that traffic between VN-A and VN-B is being mirrored to the analyzer VM.
Command Line Interface
We can also verify the network mirroring from the vRouters by using the mirror command.
mirror
root@node14:~# mirror --dump Mirror Table Flags:D=Dynamic Mirroring Index NextHop Flags VNI -------------------------------------- 0 57 D 0
In the CLI output, we can see that Dip is 10.250.0.3, which is the IP address of the analyzer VM.
root@node14:~# nh --get 57 Id:57 Type:Tunnel Fmly: AF_INET Rid:0 Ref_cnt:2 Vrf:-1 Flags:Valid, Udp, Copy SIP, Oif:0 Len:14 Flags Valid, Udp, Copy SIP, Data:00 00 00 00 00 00 52 54 00 56 ba 7e 08 00 Vrf:-1 Sip:10.168.10.14 Dip:10.250.0.3 Sport:8097 Dport:8099
Examining the flow between 10.1.0.3 and 10.2.0.3, we can see the correct Mirror Index: 0.
root@node14:~# flow --match 10.2.0.3 Flow table(size 80609280, entries 629760) Entries: Created 24923 Added 24923 Deleted 49802 Changed 49804 Processed 24923 Used Overflow entries 0 (Created Flows/CPU: 2473 2558 2088 1429 1266 1388 1252 1317 1417 1582 1178 1544 1739 1060 1091 1541)(oflows 0) Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port) Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified Dm=Delete Marked TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead Listing flows matching ([10.2.0.3]:*) Index Source:Port/Destination:Port Proto(V) ----------------------------------------------------------------------------------- 97764<=>162876 10.2.0.3:20738 1 (6) 10.1.0.3:0 (Gen: 1, K(nh):70, Action:F, Flags:, QOS:-1, S(nh):50, Stats:331/27804, Mirror Index : 0 SPort 58485, TTL 0, Sinfo 10.168.10.15) 162876<=>97764 10.1.0.3:20738 1 (6) 10.2.0.3:0 (Gen: 1, K(nh):70, Action:F, Flags:, QOS:-1, S(nh):70, Stats:331/32438, Mirror Index : 0 SPort 54979, TTL 0, Sinfo 8.0.0.0)
Similar results can be found in node15, which hosts VM-B1.