UCS Span port configuration

[manmeetmarwah]

Hi Team,

We have a customer scenario wherein we are using UCS Chassis along with Fabric Interconnects in a virtualized environment using VMware. The applications deployed are contact center applications of Cisco, Aspect and NICE recording.

Fabric Interconnects are connected to the Cisco 4500 switch having Sup7 over 10 Gbps connections. The issue is that we want to mirror the Voice traffic ( RTP) passing through Cisco 4500 switch to the NICE recording server which is one of the VMs residing on UCS.

Need your help in suggesting configuration so as to mirror the RTP traffic flowing through Cisco 4500 to the destination virtual interface of NICE recording VM on UCS.

Regards,

Manmeet

[stmccabe]

Hello Manmeet,

You can setup a traditional SPAN session on the fabric interconnect.  It is similar to ERSPAN on the Nexus 5K if you are familiar with this.  Inorder to setup the monitoring session you can refer to the following:

http://www.cisco.com/en/US/partner/docs/unified_computing/ucs/sw/cli/config/guide/1.4.1/CLI_Config_Guide_1_4_1_chapter42.html#task_C9A74F58E8FC4E1FB13F87F769569D46

Thanks,

Stephen McCabe

[manmeetmarwah]

Thanks Stephen for your reply.

However there are 2 issues:

1) The source port is on a 4500 switch and not on UCS fabric interconnect.

2) Destination port would be a Virtual port on one of the VMs installed in a blade of UCS.

Something of the sort of RSPAN required to achieve this....but one of the conditions in the document as per your link says that source and destination ports have to be on the same switch.

Don't know whether we can use ERSPAN in this case.

Regards,

Manmeet

[Robert Burns]

Manmeet,

You'd need to create an ERSPAN session on the 4500 and set the destination as the VM's sniffing IP Interface.  I would suggest creating a dedicated second vNIC on your destination VM on the appropriate VLAN and assigned with the proper IP.

There's no real config need on UCS to accomplish this.  SPAN is for mirroring traffic on the same switch, so you'll need to use an Encapsulated Remote-SPAN (ERSPAN).

Regards,

Rob

[manmeetmarwah]

Thanks Robert.

As per the cisco documentation, ERSPAN is not supported on 4500 with Sup7.

Please suggest if you have deployed this solution.

Regards,

Manmeet

[Robert Burns]

You might have to get creative here and setup a standard local SPAN on the 4500 to a port connected to the 6500, then ERSPAN it from the 6500 to the VM's IP.

Regards,

Robert

[daniel.salud69]

hi Stephen,

I am more of a DC guy (not network for sure) from a skills background perspective. I just want to know what my options are. We have a bare metal server on Cisco UCS and to be more specific it is associated to a B420 blade.  We are interested to capture packets from FI to the Nexus 5K which is on a Vblock.  I do not have access to Cisco so I have my regular CDO/CCO account. Will I be able to configure SPAN on the FI to capture inbound/outbound from the FI to and from the N5K ? please give me some guidance and pointers. I have zero SPAN experience. Thank you.

Regards,

Daniel

[Gustavo Novais]

I have the same question, but this time it is to span a WLC port over to a VM running ISE. I have 4500 sup2+ and was thinking about using a remote span vlan from the 4500 to a separate NIC on the ISE server, running on a vswitch in promiscuous mode. Am wondering if the Fabric Interconnect in EHV mode will accept spanned traffic (not directed to any of its server blades, or known about mac addresses).

Anybody can tell me if this would work?

Gustavo Novais

[YanL]

As far as I know it's still not supported to send monitoring traffic to a UCS B Chassis. see this Cisco request CSCtr80980.

https://supportforums.cisco.com/discussion/12588571/turn-mac-leaning-ucs

[daniel.salud69]

hi Yan,

does this mean, I can enable SPAN on the FI port-channel links to the N5Ks ?

Thanks.

-Daniel