知
某局点S6520X设备做流镜像流量丢失的典型案例
2022-07-29
发表
- 0关注
- 0收藏 977浏览
组网及说明
上行核心监控口连接到tap交换机，流量传输到tap。tap下联各种安全设备
问题描述
现场需要将现网的流量复制一份到安全设备上好监控现网，但在tap交换机上面配置流镜像后发现丢失了很多流量。
过程分析
查看配置并没有发现什么问题
monitoring-group 1
monitoring-port Ten-GigabitEthernet1/0/5
monitoring-port Ten-GigabitEthernet1/0/7
monitoring-port Ten-GigabitEthernet1/0/8
#
monitoring-group 2
monitoring-port Ten-GigabitEthernet1/0/5
monitoring-port Ten-GigabitEthernet1/0/6
monitoring-port Ten-GigabitEthernet1/0/8
monitoring-group 3
monitoring-port Ten-GigabitEthernet1/0/10
interface Ten-GigabitEthernet1/0/1
port link-mode route
qos apply tap policy tap1 inbound
#
interface Ten-GigabitEthernet1/0/2
port link-mode route
qos apply tap policy tap2 inbound
#
interface Ten-GigabitEthernet1/0/3
port link-mode route
qos apply tap policy tap3 inbound
traffic classifier tap operator and
if-match any
#
traffic behavior tap1
redirect monitoring-group 1
#
traffic behavior tap2
redirect monitoring-group 2
#
traffic behavior tap3
redirect monitoring-group 3
qos tap policy tap1
classifier tap behavior tap1
#
qos tap policy tap2
classifier tap behavior tap2
#
qos tap policy tap3
classifier tap behavior tap3
但是看 display interface确实流量少很多
Ten-GigabitEthernet1/0/10
Current state: UP
Line protocol state: UP
Description: Ten-GigabitEthernet1/0/10 Interface
Bandwidth: 10000000 kbps
Last time when physical state changed to down:2011-01-01 19:10:12
Peak input rate: 0 bytes/sec, at 00-00-00 00:00:00
Peak output rate: 56773493 bytes/sec, at 2011-01-01 19:46:39
Last 300 seconds input: 0 packets/sec 0 bytes/sec 0%
Last 300 seconds output: 164618 packets/sec 53994430 bytes/sec 5%
Input (total): 0 packets, 0 bytes
0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
Input (normal): 0 packets, 0 bytes
0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
Input: 0 input errors, 0 runts, 0 giants, - throttles
0 CRC, - frame, 0 overruns, - aborts
- ignored, - parity errors
Output (total): 362865779 packets, 110900698081 bytes
362863116 unicasts, 0 broadcasts, 2712 multicasts, 0 pauses
Output (normal): 362866029 packets, 110900838986 bytes
362863317 unicasts, 0 broadcasts, 2712 multicasts, 0 pauses
Output: 0 output errors, 0 underruns, - buffer failures
- aborts, - deferred, - collisions, - late collisions
- lost carrier, - no carrier
Ten-GigabitEthernet1/0/3
Current state: UP
Line protocol state: UP
Description: Ten-GigabitEthernet1/0/3 Interface
Last 300 seconds input: 529680 packets/sec 427122683 bytes/sec 35%
Last 300 seconds output: 0 packets/sec 0 bytes/sec 0%
Input (total): 1180798493 packets, 940189172642 bytes
1146770247 unicasts, 20268295 broadcasts, 13760007 multicasts, 0 pauses
Input (normal): 1180799129 packets, 940189610659 bytes
1146770823 unicasts, 20268299 broadcasts, 13760007 multicasts, 0 pauses
测试使用本地镜像是没有问题的。
解决方法
查看对应配置指导是有说明的
1.9 接口入方向上应用TAP策略
1. 配置限制和指导
暂不支持在三层以太网接口/三层聚合接口/三层以太网子接口/三层聚合子接口上应用TAP策略。
改成二层口后正常
当设备连接在生产网络和监控设备之间仅作为TAP使用时，请开启全局TAP模式。开启全局TAP模式后，设备将会关闭二层报文转发功能，防止环路和广播风暴的产生。
0
个评论
该案例暂时没有网友评论
编辑评论
✖
案例意见反馈
➤
✖
亲~登录后才可以操作哦!
确定
✖
✖
你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
✖