Troubleshooting Guide

To modify a port mirroring instance, first disable the instance. Also, to change a port or MLT entry,
first remove whichever parameter is attached to the entry, and then add the required entry.
ACLs, ACEs, and port mirroring
You can configure an ACL or an ACE to perform the mirroring operation. To do so, you can
configure the ACL global action to mirror, or you can configure the ACE action to mirror. If you use
the global action, mirroring applies to all ACEs that match in an ACL.
To decouple flow-based mirrors from port-based mirrors, ACEs use a parameter called mirror, which
you can configure to specific mirror to MLT ID, VLAN, port, or port list.
You can use filters to reduce the amount of mirrored traffic. To use filters with port mirroring, you
must use an ACL-based filter. Apply an ACL to the mirrored port in the egress and ingress
directions. Traffic patterns that match the ACL or ACE with an action of permit are forwarded to the
destination and also to the mirroring port. Traffic patterns that match an ACE with an action of drop
(deny) are not forwarded to the destination, but still reach the mirroring port For example, for an ACL
or ACE with a match action of permit and debug mirroring enabled, packets are mirrored to the
specified mirroring destination on the ACE. If you enable a port or VLAN filter, that filter is the
mirroring filter.
You can specify more than one mirroring destination by using multiple ACEs. Use each ACE to
specify a different destination.
You can configure a port-based and a flow-based mirroring filter on the same port. If such a case
occurs, then the flow-based mirror takes precedence.
For more information about how to configure ACLs and ACEs, see Configuration - QoS and ACL-
Based Traffic Filtering Avaya Virtual Services Platform 4000 Series, NN46251-502.
Port mirroring considerations and restrictions
Although you can configure Virtual Services Platform 4000 to monitor both ingress and egress
traffic, some restrictions apply:
• VSP 7000 and VSP 8000 do not support true egress mirroring. Of the VOSS platforms, only
VSP 4000 supports true egress mirroring.
On the VSP 7000 and VSP 8000, egress mirrored packets can differ from the packets
egressing the port due to the hardware limitation.
• Mirrored traffic shares ingress queue and fabric bandwidth with normal traffic and therefore can
impact normal traffic. Therefore, use these features with this potential consequence in mind
and enable them only for troubleshooting, debugging, or for security purposes such as packet
sniffing, intrusion detection, or intrusion prevention.
• You can configure as many ingress mirroring flows as you have filters.
• To avoid VLAN members from seeing mirrored traffic, you must remove mirroring (destination)
ports from all VLANs.
• The MAC drops an errored packet, for example, packets that are too short or too long. Control
packets consumed by the MAC (802.3x flow control) are also not mirrored.
• Certain control packets generated by the CP, such as CFM, STG BPDUs, SONMP, EAPOL,
LACP, VLACP, TDP, and LLDP cannot be egress mirrored due to HW limitations.
• VSP 4000 supports a maximum of 256 IPv6 ingress port/vlan security ACL/filters. IPv6 ingress
QoS ACL/Filters and IPv6 Egress Security and QoS ACL/Filters are not supported.
Port mirroring
January 2017 Troubleshooting 33
Comments on this document? [e-mail]