Netmon Docs · Device Configuration Guide

HPE Aruba ArubaOS-CXv7.0.20

Set up local mirror sessions and IPFIX flow export on HPE Aruba AOS-CX switches so Netmon can see the traffic crossing them.

Covers AOS-CX switches running release 10.x (e.g. 6300, 6400, 8100, 8325, 8360 series). AOS-CX uses local port mirroring for SPAN-style copies and exports flow telemetry as IPFIX (NetFlow v5/v9 are not offered on AOS-CX).

Mirror traffic (SPAN)

AOS-CX builds a local mirror by creating a mirror session, adding one or more source interfaces (each with a direction), and pointing the session at a destination interface that you cable to a Netmon NIC running in Sniffer mode.

Enter configuration mode and create a mirror session.

switch# configure terminal
switch(config)# mirror session 1

Add the source interface(s) to mirror. The optional direction is both (tx + rx), rx (received only), or tx (transmitted only).

switch(config-mirror-1)# source interface <member/slot/port> both

You can add more sources to the same session, including a LAG:

switch(config-mirror-1)# source interface <member/slot/port> rx
switch(config-mirror-1)# source interface lag<id> both

Set the destination interface (the port cabled to the Netmon sniffer NIC). A session has a single destination interface; a port already in a LAG is not a valid destination.
```
switch(config-mirror-1)# destination interface <member/slot/port>
```
Verify the session.
```
switch(config-mirror-1)# show mirror
```

Note

The destination port copies live traffic only; connect it to a Netmon NIC set to Sniffer (manual). See Receiving the Data in Netmon.

Important

Mirroring to a LAG destination where the attached device runs LACP can flap the LAG link if LACP frames are part of the mirrored source. Use a plain Ethernet destination port for the Netmon sniffer connection.

Source: AOS-CX CLI Bank (cli_832x), Mirroring commands — source interface / destination interface. https://arubanetworking.hpe.com/techdocs/AOS-CX/AOSCX-CLI-Bank/cli_832x/Content/Chp_Mirror/Mirror_cmds/des-int-10.htm

Export flow data

AOS-CX exports flow telemetry as IPFIX (NetFlow v10) only — it does not implement NetFlow v5 or v9. Netmon’s collector accepts IPFIX on UDP 9996. The AOS-CX flow exporter defaults to UDP 4739, so you must override the transport port to 9996. An IPFIX configuration is built from four parts: a flow record (the fields to export), a flow exporter (where to send it), a flow monitor (record + exporter), and a per-interface application of that monitor.

Create a flow record defining the fields to export. (IPv4 example; create a parallel match ipv6 ... record if you also monitor IPv6.)

switch# configure terminal
switch(config)# flow record flowRecordv4
switch(config-flow-record)# match ipv4 protocol
switch(config-flow-record)# match ipv4 source add
switch(config-flow-record)# match ipv4 destination add
switch(config-flow-record)# match ipv4 version
switch(config-flow-record)# match transport destination port
switch(config-flow-record)# match transport source port
switch(config-flow-record)# collect counter bytes
switch(config-flow-record)# collect counter packets
switch(config-flow-record)# collect timestamp absolute first
switch(config-flow-record)# collect timestamp absolute last
switch(config-flow-record)# exit

Create a flow exporter pointing at the Netmon appliance, and override the transport port to 9996 (the default is 4739). Use the address Netmon knows this switch by; if the exporter reaches Netmon over a non-default VRF, add vrf <vrfname>.

switch(config)# flow exporter flowExternal
switch(config-flow-exporter)# destination type hostname-or-ip-addr
switch(config-flow-exporter)# destination <netmon-ip>
switch(config-flow-exporter)# transport udp 9996
switch(config-flow-exporter)# exit

Create a flow monitor that binds the record to the exporter.

switch(config)# flow monitor flowMonv4
switch(config-flow-monitor)# record flowRecordv4
switch(config-flow-monitor)# exporter flowExternal
switch(config-flow-monitor)# exit

Apply the flow monitor to the interface(s) you want to account for, in the inbound direction.
```
switch(config)# interface <member/slot/port>
switch(config-if)# ip flow monitor flowMonv4 in
switch(config-if)# exit
```
For IPv6 traffic, apply the corresponding IPv6 monitor on the same interface:
```
switch(config-if)# ipv6 flow monitor flowMonv6 in
```

Verify the configuration.

switch(config)# show flow exporter
switch(config)# show flow monitor

Note

Confirm the exporter shows Port : 9996 under Transport Configuration in show flow exporter; if it still reads 4739, re-apply transport udp 9996. Also enable Allow Netflow Data Collection for this device in Netmon — see Receiving the Data in Netmon.

Important

AOS-CX does not export NetFlow v5/v9 or sFlow on the IPFIX exporter — the only flow protocol from flow exporter is IPFIX. Point the exporter at UDP 9996 (Netmon’s IPFIX port), not the sFlow port (6343). The ip flow monitor ... in interface command and v2-profile flow support apply to specific platforms/releases (interface command introduced in 10.11); on chassis families confirm your switch is running a supported profile before applying.

Source: AOS-CX 10.14.xxxx Monitoring Guide — Configuring IP Flow Information Export on 6300, 6400, 8100, 8360 and 8325 Switches; flow exporter; ip|ipv6 flow monitor (interface). https://arubanetworking.hpe.com/techdocs/AOS-CX/10.14/HTML/monitoring_6300-6400/Content/Chp_flow/conf-ipfix.htm

PreviousArista EOS NextHPE Aruba ArubaOS-Switch (ProVision)