Netmon Docs · Device Configuration Guide

Extreme EXOS / Switch Enginev7.0.20

Configure ExtremeXOS / Switch Engine switches to mirror traffic with named mirror instances and export flow data over sFlow.

Covers Extreme Networks switches running ExtremeXOS (now branded Switch Engine) — for example the ExtremeSwitching 5320/5420/5520/5720 and X-series families. ExtremeXOS uses named mirror instances for SPAN-style copy-to-port, and sFlow as its switch-wide flow-export protocol (IPFIX is supported only on specific hardware; classic NetFlow v5/v7/v9 is not exported).

Mirror traffic (SPAN)

ExtremeXOS mirroring copies traffic from one or more source ports (or VLANs) to a monitor/destination port. You create a named mirror instance, attach source filters with direction (ingress/egress/both), point the instance at the destination port wired to the Netmon sniffer NIC, and enable it.

Create a named mirror instance (the destination is attached in the next step):
```
create mirror mirror_name
```
Point the instance at the monitor (destination) port that is cabled to the Netmon appliance:
```
configure mirror mirror_name to port <dest-port>
```
Add the source port(s) to copy from, choosing the direction. Use ingress for received traffic, egress for transmitted traffic, or omit the keyword for both:
```
configure mirror mirror_name add port <source-port> ingress
```
To mirror a whole VLAN’s ingress traffic instead of a physical port:
```
configure mirror mirror_name add vlan <vlan-name>
```
Enable the mirror instance:
```
enable mirror mirror_name
```

Note

For port filters, omitting the direction keyword mirrors both ingress and egress. For VLAN and virtual-port (port + VLAN) filters, only ingress traffic is mirrored — you cannot specify ingress or egress on those. Up to 128 mirroring filters can be configured per instance, with a maximum of 16 VLAN and/or virtual-port filters.

Important

Mirrored data consumes switch fabric bandwidth, so normal forwarding and mirroring may not both run at line rate. The hardware supports up to four ingress mirroring instances and two egress mirroring instances. Size the destination port at or above the aggregate of the mirrored sources, and verify the destination port is connected to the Netmon NIC set to Sniffer (manual) — see Receiving the Data in Netmon.

Source: ExtremeXOS® User Guide — Configuring Mirroring / Guidelines for Mirroring. https://documentation.extremenetworks.com/exos_32.3/GUID-EFCFFB39-8778-42AD-87A3-E3EB42C7DF60.shtml

Source: Switch Engine Command Reference Guide, Version 32.1 (configure mirror add). https://documentation.extremenetworks.com/switchengine_commands_32.1/GUID-D93B42A9-9201-45DA-8962-6B9EC6CA9379.shtml

Export flow data

ExtremeXOS exports flow data using sFlow (datagram v5) on UDP 6343 — this is the switch-wide, hardware-independent path and is what you should use to send flow data to Netmon. You configure a remote collector (the Netmon appliance), turn on sFlow on the ports of interest, then enable sFlow globally.

Configure the Netmon appliance as the remote sFlow collector. UDP 6343 is the default sFlow port and matches Netmon, so the port keyword is optional; the default virtual router is VR-Mgmt — specify the VR that routes from the switch to Netmon:
```
configure sflow collector <netmon-ip> vr VR-Mgmt
```
To point sFlow at a non-default UDP port (only if you changed Netmon’s sFlow listener), add the port keyword:
```
configure sflow collector <netmon-ip> port <udp-port> vr VR-Mgmt
```
Enable sFlow sampling on the desired ports, optionally setting a sample rate and direction (ingress, egress, or both; ingress is the default if no type is given):
```
configure sflow ports <port-list> sample-rate 8192
enable sflow ports <port-list> egress
```
Enable sFlow globally on the switch:
```
enable sflow
```
Confirm the collector, agent, and per-port state:
```
show sflow configuration
```

Note

You can configure up to four remote collectors. If the Netmon collector is not directly attached to the switch, make sure the VR you specify (commonly VR-Mgmt) is the one that forwards traffic between the switch and the collector. Set the sFlow agent/source address so Netmon sees the switch at the address it is monitored by: configure sflow agent ipaddress <switch-mgmt-ip>.

Important

ExtremeXOS does not export classic NetFlow (v5/v7/v9). IPFIX (NetFlow v10) support is hardware-dependent: the mirror ip-fix option mirrors the first fifteen packets of every IPFIX flow to a port for deep packet inspection, and is available on the ExtremeSwitching Switch Engine series (5320/5420/5520/5720) and a range of X-series platforms (for example the X460-G2). It is driven through the mirror filter: configure mirror mirror_name add port <source-port> ip-fix. On platforms that do not support it, use sFlow as shown above. Netmon accepts sFlow v2/v4/v5+ on UDP 6343. Remember to enable Allow Netflow Data Collection on the device entry in Netmon — see Receiving the Data in Netmon.

Source: ExtremeXOS® User Guide, Version 30.4 (sFlow Configuration Example). https://documentation.extremenetworks.com/exos_30.4/GUID-5A708A29-586A-4B65-A9DA-17F561A2A3AF.shtml

Source: ExtremeXOS 22.1 User Guide (Configuring the Remote Collector Address). https://documentation.extremenetworks.com/exos_22.1/GUID-4F940519-81DA-471B-BBA8-B815109AE45C.shtml

PreviousDell PowerSwitch OS10 NextFortinet FortiGate (FortiOS)