Need help with SPAN/RSPAN on VOSS

[industrialblue]

Hello,

I'm fairly new to Extreme and VOSS (1.5 years) and have a requirement to setup a span port for network analysis/intrusion detection.  After reading all the documentation i could on Extreme's site, I'm a but perplexed what the approach to my scenario is.

The site in question has two IDFs connected via fiber.  5420M's TOR in each IDF with 5420F's below them (The M's have the fiber between them).  The dilemma is I need to monitor ingress/egress on the port connected to our firewall (which is a MLT).  The analyzer is in the other IDF on a server connected to the other 5420M.

Basically I need to mirror port 52 one one M to the other M on port 30.  I've read about monitoring to an i-sid, but I'm not sure if that's the best approach, overkill, or if this is the appropriate way to do it.  I'm not sure what that config would look like.

Could anyone help an Extreme newbie out?

Thanks.

[Yoann_Jonard]

Hello,

You should be fine with this KB: https://extreme-networks.my.site.com/ExtrArticleDetail?an=000072912

On M1 : 

#mirror-by-port 1 in-port 1/52 monitor-isid-offset 3 mode both

On M2:

#monitor-by-isid 1 monitor-isid-offset 3 egress-ports 1/30

If your Firewall is connected through a MLT (both ports on M1), you just need to add the ports belonging to the mlt (let's sayt 1/51,1/52).

[industrialblue]

Thank you, Yoann.  I will try this next week during a maintenance window.  I appreciate the reply and will report back.