Remote Mirror over MLAG

[akannemeyer]

Hi Community

We have the above configuration.

The core consists of two x690's configured as MLAG peers. I have MLAG's connecting to my two Firewalls and a Mlag connecting to my edge x440.

We need to configure remote mirroring to a "Monitoring server" connected to the x440. We want to mirror all the traffic from the firewalls to the monitoring server.

When we look at the remote mirroring config we can mirror to a specific mirror vlan and then just tag the vlan to the monitoring server.

Reference: https://extreme-networks.my.site.com/ExtrArticleDetail?an=000080241&q=how%20to%20configure%20remote%...

The question I have is when we utilize MLAGS. 

When creating this vlan remote mirror you specify the uplink port as a mirror destination port with the remote tag: Example = configure mirror to port 1 remote-tag 1000

With MLAG we still have to take the ISC to take into consideration

Do we need to add the ISC on the mirror config?

[Gabriel_G · Accepted solution]

Hello!

I'll note that the EXOS User Guide doesn't mention any restrictions or requirements for remote-mirroring plus MLAG so this is likely to work, but I'd recommend testing this first before depending on it in production.

Regarding your questions on if you should add the remote-mirror VLAN to the ISC, the answer is likely yes.

While no useful mirror traffic should traverse the ISC when all links are up and working, in the scenario where the link between 1 of the x690s and the x440 goes down, you'll need the remote-mirror VLAN on the ISC to allow traffic to continue to traverse southbound when it goes from the firewall to the x690 where the link to the x440 is down. The firewalls cannot see that the link between the x690 and the x440 is down so they'll send southbound traffic to either x690, in turn requiring the remote-mirror VLAN on the ISC to allow it to continue to flow southbound via the other x690. MLAG should prevent packet duplication or loop behavior around any MLAG links.

An alternative and simpler setup would be to use L3 based remote-mirroring with GRE tunnels (ERSPAN) if your monitoring server can understand that. This doesn't depend on any specific mirroring VLAN and instead just encapsulates mirrored traffic in unicast GRE packets that are sent to the destination server just like any other traffic. I don't have a nice KCS for this, but the config is similar to a basic mirror but instead of 'configure mirror <mirror> to port <#>', the command becomes 'configure mirror <mirror> to remote-ip <IP of Dest Server>'. Configuration info and other mirroring restrictions are mentioned in the EXOS User Guide, page 297 (Remote Mirroring) and Page 302 (Remote Mirroring Using Layer 3).

https://documentation.extremenetworks.com/exos_31.7/downloads/EXOS_User_Guide_31.7.pdf

Hope that helps!