Configuring VLAN-based filtering for SPAN or RSPAN
SPAN and RSPAN on RUCKUS ICX switches can monitor network traffic on a source port and mirror a copy of the traffic to a destination analyzer port on the same switch or on other ICX switches in the network. The source port, however, can carry tagged or untagged traffic from multiple VLANs. SPAN or RSPAN mirrored traffic can be filtered out by VLAN ID so that only traffic from VLANs that require monitoring is carried on for analysis.
Configure VLAN-based filtering with the mirror-filter source vlan
command as shown in the scenarios described in the following sections.
Considerations for VLAN-based filtering of SPAN or RSPAN mirrored traffic
Keep the following points in mind when configuring VLAN-based filtering.
- A maximum of 72 VLANs can be mirror-filtered, contingent on TCAM availability.
- If the RSPAN destination uplink is the same as the forwarding path, the number of mirror traffic sources configured should be appropriate to the bandwidth available for forwarding traffic.
- VLAN filtering of mirrored packets and ACL mirroring cannot co-exist on the same device.
- VLAN mirroring and "mirror-filter source vlan" configuration cannot co-exist on the same device.
- Port mirroring and RSPAN cannot co-exist on the same ICX device.
- All VLANs that require filtering must exist on the ICX device.
- A maximum of 36 VLANs are supported in one configured VLAN range.
- A maximum of four physical ports can be configured in an analyzer destination LAG.
- A mirrored port cannot be deleted if the mirror filter is configured.
- An ACL mirror filter will be added only when mirroring (rspan/mirror port) is configured.