Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Troubleshooting Port Mirroring

Troubleshooting Port Mirroring

Egress Port Mirroring with VLAN Translation

Problem

Description

If you create a port-mirroring configuration that mirrors customer VLAN (CVLAN) traffic on egress and the traffic undergoes VLAN translation before being mirrored, the VLAN translation does not apply to the mirrored packets. That is, the mirrored packets retain the service VLAN (SVLAN) tag that should be replaced by the CVLAN tag on egress. The original packets are unaffected—on these packets VLAN translation works properly, and the SVLAN tag is replaced with the CVLAN tag on egress.

Solution

This is expected behavior.

See Also

Egress Port Mirroring with Private VLANs

Problem

Description

If you create a port-mirroring configuration that mirrors private VLAN (PVLAN) traffic on egress, the mirrored traffic (the traffic that is sent to the analyzer system) has the VLAN tag of the ingress VLAN instead of the egress VLAN. For example, assume the following PVLAN configuration:

  • Promiscuous trunk port that carries primary VLANs pvlan100 and pvlan400.

  • Isolated access port that carries secondary VLAN isolated200. This VLAN is a member of primary VLAN pvlan100.

  • Community port that carries secondary VLAN comm300. This VLAN is also a member of primary VLAN pvlan100.

  • Output interface (monitor interface) that connects to the analyzer system. This interface forwards the mirrored traffic to the analyzer.

If a packet for pvlan100 enters on the promiscuous trunk port and exits on the isolated access port, the original packet is untagged on egress because it is exiting on an access port. However, the mirror copy retains the tag for pvlan100 when it is sent to the analyzer.

Here is another example: If a packet for comm300 ingresses on the community port and egresses on the promiscuous trunk port, the original packet carries the tag for pvlan100 on egress, as expected. However, the mirrored copy retains the tag for comm300 when it is sent to the analyzer.

Solution

This is expected behavior.

Troubleshooting Port Mirroring Configuration Error Messages

Troubleshooting issues with port mirroring on EX Series switches:

An Analyzer Configuration Returns a “Multiple interfaces cannot be configured as a member of Analyzer output VLAN” Error Message

Problem

Description

In an analyzer configuration, if the VLAN to which mirrored traffic is sent contains more than one member interface, the following error message is displayed in the CLI when you commit the analyzer configuration and the commit fails:

Solution

You must direct the mirrored traffic to a VLAN that has a single member interface. You can do this by completing either of these tasks:

  • Reconfigure the existing VLAN to contain a single member interface. You can choose this method if you want to use the existing VLAN.

  • Create a new VLAN with a single member interface and associate the VLAN with the analyzer.

To reconfigure the existing VLAN to contain only one member interface:

  1. Remove member interfaces from the VLAN repeatedly by using either the delete vlan command or the delete interface command until the VLAN contains a single member interface:

  2. (Optional) Confirm that the VLAN contains only one interface:

    The output for this command must display only one interface.

To create a new VLAN with a single member interface:

  1. Configure a VLAN to carry the mirrored traffic:

  2. Associate an interface with the VLAN:

  3. Associate the VLAN with the analyzer: