V4ACISPAN_Enhancements_H_sokhande 1

SPANenhancementsinACI4.1,SonuKumarKhandelwalTechnicalMarketingEngineer,SPANEnhancementsinACI4.1,SPANisoneofthemostimportanttoolwhiletroubleshootinganetworkissue.InACI4.1,weareintroducing3keyfunctionalitiesforSPANSPANondropSPANbasedonfilterSPANwithdestinationasPort-channel,SPANondrop,IntroductiontoSPANondrop,SPANondropfeatureinACI4.1,allowscustomertocapturethepacketsthataredroppedbyfabric.SPANondropworksonlyforingresspipelinedropssuchasforwardingdrops,policydrops,andpacketerrors.Droppedpacketscanbespannedtoexternaldestination.SPANondropdoesntworkforegresspipelinedropsuchasbufferdropsoregressdrops.Onamodularchassis,theSPAN-on-dropfeaturewillonlyworkforthepacketsdroppedonthelinecards.Packetsthataredroppedonthefabriccardwillnotbespanned.CustomercanenablespanondroppacketsforbothFabricandaccessSPAN.FabricSPANcanbeenabledonfabriclinksofLeafandSpine,andwillcapturedroppedpacketstoSPANdestinations.FabricSPANfordroppedpacketscanalsobeenabledforthewholeLeaforSpineinsteadofenablingforeachlinkSPANondropforaccessinterfacescancapturedroppedpacketsforthespecifiedaccessinterfacesintheSPANconfiguration.ThisfeatureworksforanyleaforSpinefromEXonwards.,EnablingSPANondropforFabricSPAN,EnableSPANondrop,DefineNodeorinterfacesinFabricSPAN,FabriclinkofleaforSpine.DroppedpacketsfromtheseinterfaceswillbespannedtoSPANdestination.,SourceLeaforSpine.Droppedpacketfromthesenodeswillbespannedtospandestination.,DefineNodeorinterfacesfortheSPANondrop,Accessinterfacesofleaf.DroppedpacketsfromtheseinterfaceswillbespannedtoSPANdestination.,SPANondropwithdestinationtoAPICcontroller,SPANondropsessionwithdestinationtoAPICcontrollercanbecreatedusingCLIinACI4.1release.ThisfunctionalitywillbeprovidedthroughNIRAPPinfuture.,APICasspanDestination:troubleshootnodesessionmonitordestinationapic_ipsrcipprefixdropenableerspan-idoptionalSpecifytheERSPANDestinationaswelltroubleshootnodesessionmonitordestinationtenantapplicationepgdestipsrcipprefixdropenableerspan-idoptionalSampleconfigbelow:site2-apic1(config)#troubleshootnodesession301-GD-APICnodeid301DestinationasAPIC:site2-apic1(config)#troubleshootnodesession301-GD-APICmonitordestinationapicsrcipprefix13.13.13.13dropenable,SPANondroppacketformat,DroppedpacketscapturedatingressofthefabriclinksonSpineorleafwillhaveiVXLANheader.DroppedpacketscapturedatingressoftheaccesslinksonleafwillhaveOriginalpacketencapsulatedinERSPANheaderifdestinationisnotlocalinterfaceOriginalpacketifdestinationislocalinterfaceThisbehaviorofpacketencapsulationissamebetweenSpanonDropandregularspancases.,Faults,AfaultisgeneratediftheSPANondropsessiondoesnotcomeup.,Scale&Considerations,SPANondropsessioniscountedagainstthetotalscaleofSPANsessionperleaforfabric.SPANondropsessionandSPANonfilterisnotsupportedtogetherSPANondropsessionisnotsupportedwithtenantSPANSPANondropsessioncanbeconfiguredonregularports/FEX/VPC/PC/Breakoutportswithregularspanondropsession,howeverwithTroubleshootCLI,wecannotspecifyVPC/PCports.,Verification,Verification,orion52-SS-303#showmonitorsessionallsession3-name:303-CLI-GDdescription:Spansession3type:erspanversion:2operversion:2state:up(active)erspan-id:1granularity:vrf-name:common:v1acl-name:ip-ttl:64ip-dscp:ip-dscpnotspecifieddestination-ip:179.10.10.179/32origin-ip:33.33.33.33mode:global-dropFilterGroup:Nonesourceintf:rx:tx:both:sourceVLANs:rx:tx:both:filterVLANs:filternotspecifiedfilterL3Outs:filternotspecified,session5-name:303-CLI-SOD-ESX164-PCdescription:Spansession5type:erspanversion:2operversion:2state:up(active)erspan-id:1granularity:vrf-name:common:v1acl-name:ip-ttl:64ip-dscp:ip-dscpnotspecifieddestination-ip:179.10.10.179/32origin-ip:33.3.3.33mode:access-dropFilterGroup:Nonesourceintf:rx:Po1tx:Po1both:Po1sourceVLANs:rx:tx:both:filterVLANs:filternotspecifiedfilterL3Outs:filternotspecified,GlobalSPANondropsessionforthewholeleaf,AccessinterfaceSPANondropsession,SPANbasedonfilter,Currentchallengeswithoutspanbasedonfilter,CustomersbeforeACI4.1releasecanfilterSPANtrafficbasedonVlan/EPG,butitwasnotpossibletofurtherfilterSPANtrafficbasedon5tuples(sourceIP,DestinationIP,Protocol,SourcePortandDestinationPort.Duetothiscustomermayspanuninterestedtraffic.Tosolvethischallenge,inACI4.1,wearesupporting5-tuplesbasedfilterforspantraffic.,DetailsofSPANbasedonfilter,ACI4.1,allowscustomerstoconfigureaSPANfilterwith5-tuples(sourceIP,destinationIP,sourceport,destinationportandprotocol)andputthefiltersintoafiltergroupFiltergroupscanthenbeattachedtoaccessSPANsessionAccessSPANfiltergroupcapturesandfilterthespanpacketsontheaccessinterfaces.SPANfiltercanbeappliedforbi-directionaltrafficSPANfiltercanbeappliedonaparticularSPANsourceorforthewholeSPANsourcegroup.Filterappliedonaparticularsourcetakesapriorityincomparisontothewholegroup,SPANFiltergroup,Filtergroupcanhavebothv4/v6addressL4Portrangescanbespecifiedinthefilterentry,AttachingSPANfiltergrouptoaSPANsource,Followingexampleshowsafiltergroup“5_tuples”isattachedtoSPANsourceinterfacePod-3/Node-105/E1/2,AttachingSPANfiltergrouptoaSPANsourcegroup,Followingexampleshowsafiltergroup“5_tuples”isattachedtomultipleSPANsources.Whenfilterisappliedtobothspansourcegroupandatspecificsource,filterappliedatspecificsourcetakespriority.,ConsiderationSPANbasedonfilter,SPANbasedonfilterisnotavailableforFabricSPANsincefabricspancapturespacketatfabriclinksbetweenleafandspine.ThesepacketsareencapsulatedintoVXLANheader,and5-tuplefilterforinnerheader(usertraffic)wontbeabletofilterpacketswithouterVXLANheader.TenantSPANisnotsupportedwithspanfilter.TenantspancapturestheEPGpackets.Hardwareiscapabletosupporttenantspan,butitsnotimplementedinsoftwareyet.SPANbasedonfilterissupportedonanyhardwarestartingfromEXSPANbasedonfilterandSPANondropcantbeusedtogether,Filterscalelimits,NumberoffilterentriessupportedintheTCAM=(M*S1*1+N*S2*2)+(S3*2)MisnumberofIPV4filtersS1isnumberofsourceswithIPV4filterentriesNisnumberofIPV6filtersS2isnumberofsourceswithIPV6filterentriesS3isthenumberofsourceswithnofiltergroupassociationTheabovecalculationisapplicabletorxSPANortxSPANseparately.Currently,maxfilterentriessupportedintx/rxspanis480ineachdirectionfollowingtheaboveformulaassumingtherearenoothersourcesthatareconfiguredwithoutfilter-groupassociation(meansS3=0)andwith16port-rangesincluded.Oncethenumberoffilterentriesexceedthemaxallowed,faultwillberaised.L4Portrangescanbespecifiedinthefilterentry,however16L4portsisprogrammedintohardwareasasinglefilterentry,Faults,Whenafiltergroupcontainingmorethantheallowedfilterentriesisappliedtoasource,afaultwillberaisedfortheSPANsource.,Faults,Whenanewfilterentryadditionresultsinexceedingthemaxallowedfilterentries,afaultwillberaisedfortheSPANfilterentry.,Troublesh