Monitor session 配置案例

 

CRS-ACL-Based Traffic Mirroring

1

RP/0/RSP0/CPU0:CRS #show access-lists span

2

Thu Oct 11 09:08:44.123 UTC

3

ipv4 access-list span

4

10 permit ipv4 host 10.1.12.1 host 10.1.23.3 capture           <<<加capture关键字的acl条目才会执行span

5

15 permit ipv4 host 10.2.2.2 host 10.3.3.3 

6

 20 permit ipv4 any any

7

RP/0/RSP0/CPU0:ASR9006-G#

8

9

RP/0/RSP0/CPU0:CRS#show run monitor-session cmcc ipv4

10

Thu Oct 11 09:08:00.562 UTC

11

monitor-session cmcc ipv4

12

destination next-hop 10.1.34.4

13

!

14

RP/0/RSP0/CPU0:CRS#show run int gi0/0/0/0

15

Thu Oct 11 09:06:09.369 UTC

16

interface GigabitEthernet0/0/0/0

17

ipv4 address 10.1.12.2 255.255.255.0

18

 monitor-session cmcc ipv4 direction rx-only    <<<< CRS 仅支持入向流量的SPAN，所以必须指定rx-only关键字

19

  acl

20

!

21

ipv4 access-group span ingress

22

​

CRS-SPAN over Pseudowire

ASR9000中其实是有相关的feature的，而且配置很简单，无需额外的物理连线，可以在内部直接将monitor的流量通过PW发给对端，monitor的源就相当于AC链路了，但是CRS中不支持相关的配置，但我们可以“曲线救国”，实现span的流量通过L2VPN发给对端PE.

有关ASR9K的对应feature可以参考以下的文章：

• How to Configure Traffic Mirroring over Pseudowire

以下是在CRS中通过其它方法实现的相同的功能的配置案例：如下图所示， 将Ten0/1/0/7的入向流量通过monitor-session复制到对端的5501-A.
需要使用一根光纤将Ten0/1/0/10和Ten0/1/0/6环起来。相关配置如下：

CRS-A L2VPN

1

interface TenGigE0/1/0/6    

2

 l2transport

3

​

4

l2vpn

5

 xconnect group xuxing

6

  p2p xuxing

7

   interface TenGigE0/1/0/6

8

   neighbor ipv4 218.21.155.247 pw-id 10

9

   !

10

​

11

interface TenGigE0/1/0/10

12

 ipv4 address 200.0.0.1 255.255.255.0

13

!

14

​

ASR9922 L2VPN

1

interface TenGigE0/1/0/6

2

l2transport

3

 !

4

​

5

l2vpn

6

 xconnect group xuxing

7

  p2p xuxing

8

   interface TenGigE0/1/0/6

9

   neighbor ipv4 218.25.210.64 pw-id 10

10

​

CRS-A SPAN

1

ipv4 access-list span

2

 10 permit ipv4 host 100.1.1.5 any capture

3

 20 permit ipv4 any any

4

!

5

monitor-session cmcc ipv4

6

 destination next-hop 200.0.0.2

7

!

8

​

9

interface TenGigE0/1/0/7

10

 ipv4 address 100.1.1.2 255.255.255.0

11

 monitor-session cmcc ipv4 direction rx-only

12

  acl

13

 !

14

 load-interval 30

15

 ipv4 access-group span ingress

16

!

17

​

NCS5501

1

interface TenGigE0/0/0/6

2

ipv4 address 200.0.0.2 255.255.255.0

Note

记录下SPAN后流量的封装格式：

上图，镜像流量的目的地址是10.1.13.2，那么镜像流量在CRS和Test Device之间的封装如下所示：

Some command

1

#Show monitor-session status

2

#Show monitor-session status detail

3

#show monitor-session ipv4 counters location 0/0/CPU0  <<< CRS 需要加location才能查看counter

The Blog from Xuxing's Blog;

Link: http://imxing.cn/?p=347