Re: ASR9006 span port monitor-session subinterface

GIANRICO FICHERA · ‎06-10-2021

Hello,

In an ASR9006 platform with A9K-24X10GE-TR modules and image 6.4.2 I am unable to have a working SPAN port from a source subinterface. I'm using this configuration:

!
monitor-session capture ethernet
    destination interface TenGigE0/2/0/14
!
...snip...
interface TenGigE0/1/0/22.8
  description *** END USER C1248 ***
  monitor-session capture ethernet
  !
  service-policy type control subscriber PPP_PM
  pppoe enable bba-group CUSTOMERS
  encapsulation dot1q 1605 second-dot1q 1804
!
...snip...
interface TenGigE0/2/0/14
   description --- to Wireshark server ---
   l2transport
!

The SPAN configuration appear to be operational:

RP/0/RSP0/CPU0#sh monitor-session status detail
Monitor-session capture
Destination interface TenGigE0/2/0/14
Source Interfaces
-----------------
TenGigE0/1/0/22.8
Direction: Both
Port level: False
ACL match: Disabled
Portion: Full packet
Interval: Mirror all packets
Status: Operational

The problem is that there are no packet captured:

RP/0/RSP0/CPU0#show monitor-session counters
Thu Jun 10 15:43:53.928 CET
Monitor-session capture
TenGigE0/1/0/22.8
Rx replicated: 0 packets, 0 octets
Tx replicated: 0 packets, 0 octets
Non-replicated: 0 packets, 0 octets
!

In the source interface there is traffic but in the SPAN port not.


RP/0/RSP0/CPU0#sh int TenGigE 0/1/0/22.8 | include rate
Thu Jun 10 15:44:25.924 CET
30 second input rate 537000 bits/sec, 201 packets/sec
30 second output rate 2982000 bits/sec, 771 packets/sec
!

RP/0/RSP0/CPU0#sh int TenGigE0/2/0/14
Thu Jun 10 15:46:44.689 CET
TenGigE0/2/0/14 is up, line protocol is up
Interface state transitions: 19
Hardware is TenGigE, address is 70e4.2222.5d3e (bia 70e4.2222.5d3e)
Layer 1 Transport Mode is LAN
Description: *** Porta XN2 ***
Layer 2 Transport Mode
MTU 1514 bytes, BW 10000000 Kbit (Max: 10000000 Kbit)
reliability 5/255, txload 0/255, rxload 0/255
Encapsulation ARPA,
Full-duplex, 10000Mb/s, SR, link type is force-up
output flow control is off, input flow control is off
Carrier delay (up) is 10 msec
loopback not set,
Last link flapped 2d19h
Last input 00:00:00, output 02:51:16
Last clearing of "show interface" counters 00:00:07
5 minute input rate 0 bits/sec, 1 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
3 packets input, 180 bytes, 3 total input drops
0 drops for unrecognized upper-level protocol
Received 0 broadcast packets, 3 multicast packets
0 runts, 0 giants, 0 throttles, 0 parity
765 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 packets output, 0 bytes, 0 total output drops
Output 0 broadcast packets, 0 multicast packets
0 output errors, 0 underruns, 0 applique, 0 resets
0 output buffer failures, 0 output buffers swapped out
0 carrier transitions

Do you have any idea to help me?

Thankyou

Gianrico Fichera

smilstea · ‎06-10-2021

You need to put a tag on the outgoing interface towards the capture device when using a sub-int with a VLAN tag, otherwise nothing is captured.

https://community.cisco.com/t5/service-providers-documents/asr9000-xr-how-to-use-port-spanning-or-port-mirroring/ta-p/3108031

Scroll down to "

R-SPAN configuration:"

Sam

GIANRICO FICHERA · ‎06-15-2021

Hello, thank you for your answer.

I changed the configuration trying to follow the examples you kindly showed me.

interface TenGigE0/2/0/14

transceiver permit pid all

!

interface TenGigE0/2/0/14.1 l2transport

description *** R-SPAN port ***

encapsulation dot1q 1605 second-dot1q 1804

!

interface TenGigE0/1/0/22.8

description *** CUSTOMER SIDE INTERFACE ***

monitor-session capture ethernet

!

service-policy type control subscriber PPP_PM

pppoe enable bba-group TEKNONET

load-interval 30

encapsulation dot1q 1605 second-dot1q 1804

!

Now I have this status:

RP/0/RSP0/CPU0:core.as202975.net#show monitor-session status detail

Mon Jun 14 10:41:23.395 CET

Monitor-session capture

Destination interface TenGigE0/2/0/14.1

Source Interfaces

-----------------

TenGigE0/1/0/22.8

Direction: Both

Port level: False

ACL match: Disabled

Portion: Full packet

Interval: Mirror all packets

Status: Operational

It seems that nothing changed:

RP/0/RSP0/CPU0:core.as202975.net#sh int tenGigE 0/1/0/22.8

Mon Jun 14 10:46:40.166 CET

TenGigE0/1/0/22.8 is up, line protocol is up

Interface state transitions: 11

Hardware is VLAN sub-interface(s), address is 046c.9d59.e8ce

Description: ***CUSTOMER SIDE INTERFACE ***

Internet address is Unknown

MTU 1522 bytes, BW 10000000 Kbit (Max: 10000000 Kbit)

reliability 255/255, txload 0/255, rxload 0/255

Encapsulation 802.1Q Virtual LAN, VLAN Id 1605, 2nd VLAN Id 1804,

loopback not set,

Last link flapped 3d19h

Last input 00:00:01, output 00:00:01

Last clearing of "show interface" counters 6d00h

30 second input rate 51000 bits/sec, 32 packets/sec

30 second output rate 110000 bits/sec, 28 packets/sec

135709184 packets input, 77463405249 bytes, 1635 total input drops

0 drops for unrecognized upper-level protocol

Received 0 broadcast packets, 0 multicast packets

135278267 packets output, 93171992952 bytes, 0 total output drops

Output 0 broadcast packets, 0 multicast packets

RP/0/RSP0/CPU0:core.as202975.net#sh int TenGigE0/2/0/14.1

Mon Jun 14 10:46:59.269 CET

TenGigE0/2/0/14.1 is up, line protocol is up

Interface state transitions: 1

Hardware is VLAN sub-interface(s), address is 70e4.2222.5d3e

Layer 2 Transport Mode

MTU 1522 bytes, BW 10000000 Kbit (Max: 10000000 Kbit)

reliability Unknown, txload Unknown, rxload Unknown

Encapsulation 802.1Q Virtual LAN,

Outer Match: Dot1Q VLAN 1605

Inner Match: Dot1Q VLAN 1804

Ethertype Any, MAC Match src any, dest any

loopback not set,

Last link flapped 00:16:26

Last input never, output never

Last clearing of "show interface" counters never

0 packets input, 0 bytes

0 input drops, 0 queue drops, 0 input errors

0 packets output, 0 bytes

0 output drops, 0 queue drops, 0 output errors

I don't understand the reason but in any case even now I have no traffic in the R-SPAN port.

GIANRICO FICHERA · ‎06-14-2021

Hello, thank you for your answer.

I changed the configuration trying to follow the examples you kindly showed me.

interface TenGigE0/2/0/14

transceiver permit pid all

!

interface TenGigE0/2/0/14.1 l2transport

description *** R-SPAN port ***

encapsulation dot1q 1605 second-dot1q 1804

!

interface TenGigE0/1/0/22.8

description *** CUSTOMER SIDE INTERFACE ***

monitor-session capture ethernet

!

service-policy type control subscriber PPP_PM

pppoe enable bba-group TEKNONET

load-interval 30

encapsulation dot1q 1605 second-dot1q 1804

!

Now I have this status:

RP/0/RSP0/CPU0:core.as202975.net#show monitor-session status detail

Mon Jun 14 10:41:23.395 CET

Monitor-session capture

Destination interface TenGigE0/2/0/14.1

Source Interfaces

-----------------

TenGigE0/1/0/22.8

Direction: Both

Port level: False

ACL match: Disabled

Portion: Full packet

Interval: Mirror all packets

Status: Operational

It seems that nothing changed:

RP/0/RSP0/CPU0:core.as202975.net#sh int tenGigE 0/1/0/22.8

Mon Jun 14 10:46:40.166 CET

TenGigE0/1/0/22.8 is up, line protocol is up

Interface state transitions: 11

Hardware is VLAN sub-interface(s), address is 046c.9d59.e8ce

Description: ***CUSTOMER SIDE INTERFACE ***

Internet address is Unknown

MTU 1522 bytes, BW 10000000 Kbit (Max: 10000000 Kbit)

reliability 255/255, txload 0/255, rxload 0/255

Encapsulation 802.1Q Virtual LAN, VLAN Id 1605, 2nd VLAN Id 1804,

loopback not set,

Last link flapped 3d19h

Last input 00:00:01, output 00:00:01

Last clearing of "show interface" counters 6d00h

30 second input rate 51000 bits/sec, 32 packets/sec

30 second output rate 110000 bits/sec, 28 packets/sec

135709184 packets input, 77463405249 bytes, 1635 total input drops

0 drops for unrecognized upper-level protocol

Received 0 broadcast packets, 0 multicast packets

135278267 packets output, 93171992952 bytes, 0 total output drops

Output 0 broadcast packets, 0 multicast packets

RP/0/RSP0/CPU0:core.as202975.net#sh int TenGigE0/2/0/14.1

Mon Jun 14 10:46:59.269 CET

TenGigE0/2/0/14.1 is up, line protocol is up

Interface state transitions: 1

Hardware is VLAN sub-interface(s), address is 70e4.2222.5d3e

Layer 2 Transport Mode

MTU 1522 bytes, BW 10000000 Kbit (Max: 10000000 Kbit)

reliability Unknown, txload Unknown, rxload Unknown

Encapsulation 802.1Q Virtual LAN,

Outer Match: Dot1Q VLAN 1605

Inner Match: Dot1Q VLAN 1804

Ethertype Any, MAC Match src any, dest any

loopback not set,

Last link flapped 00:16:26

Last input never, output never

Last clearing of "show interface" counters never

0 packets input, 0 bytes

0 input drops, 0 queue drops, 0 input errors

0 packets output, 0 bytes

0 output drops, 0 queue drops, 0 output errors

I don't understand the reason but in any case even now I have no traffic in the R-SPAN port.

smilstea · ‎06-16-2021

Ok so I think I know the issue, since this is BNG we need to configure SPAN via dynamic template or through CoA.

dynamic-template type <type> <name>
monitor-session <name> [ direction {rx-only|tx-only} ]
acl
mirror first <bytes>

Template can be applied to existing subscribers via
new “CoA” CLI command
test radius coa activate service <name> acct-ses-id <id>

Sam