Cisco SNA Mirror Packet

[Noffal]

Hi Expert,

My customer have used Cisco SNA (Stealthwatch) and they just buy new switch using Aruba CX which do not support Netflow (IPFIX support but for limited capability). I just thought after researched several info that Cisco SNA also able to mirror packet for collect data from switch, but I cannot find any info / guide how to collect data using that way. Does it use SPAN/RSPAN/ERSPAN or what?

Glad to hear your response

Thank You! 

[jamegill]

Hi Noffal,

SNA can indeed consume SPAN or packet mirror for monitoring. The Flow Sensor appliance is the part you’ll want to look into. That will generate the flow data SNA operates on.

—jg

[Noffal]

Hi Jamegill,

Thanks for replied, Could you help me to share URL for configuration in SNA side (especially in flow sensor) if we want to receive flow data from mirroring? Its really hard to find it.

Glad to hear your response.

Thank You! 

[David Salter]

The traffic of interest needs to be mirrored to a monitor port on the Flow Sensor. For a physical Flow Sensor, ports 5 - 8 are 10Gbps monitor ports, ports 9 and 10 are 40Gbps monitor ports.  Either 4 x 10Gbps ports can be used or 2 x 40Gbps can be used, not both simultaneously.  For a virtual sensor, the monitor ports need to be provisioned on the VM.

To add a Flow Sensor to the Manager, follow the guidance from page 87 in the configuration guide