Have a scenario where I need to take mirrors of all the connections on the network to two different destinations, the first one is N+15 for Extreme Analytics and the other for another product that requires a full mirror.
Currently the network does a policy mirror from 6 separate S-Series switches from virtually all the ports and sends the traffic via GRE tunnels directly to Extreme Analytics.
This is a problem though as the policy mirror would override a physical mirror and I can't (that I know of) send a copy of the mirror traffic to two different ports. There seems to be one exception:
But this limited to four ports?!
What I'm considering is changing the policy mirrors to physical mirrors and using a tap aggregator to send the feeds to the two different appliances.
This causes its own problems though, as although it does the job of duplicating the mirrored traffic they are both port mirrors and I need N+15 for analytics. Additionally if these are EXOS devices I can't do Netflow on these devices.
Am wondering though if something inventive could be created with an additional S-Series switch inline, like making use of a GRE tunnel. You could take a mirror from the GRE tunnel termination end and one from the physical interface (burn port) that the GRE tunnel uses... or loop back the mirror ports back to the switch and take mirrors from where they ingress and where they are looped back in etc
I know that might seem ludicrous, but hopefully gives a helpful example to my point.
Have raised a case 01517007 but no other solution could be found apart from taking mirrors from other ports not already mirrored.
Many thanks in advance