1. Display the available interfaces by selecting Fabric > Interfaces .
   The system displays the Interfaces page, which lists the interfaces connected to the DANZ Monitoring Fabric (DMF) fabric.

   

2. Select the Menu control for the interface to use and select Configure from the pull-down menu.
   The system displays the following dialog:

   

3. (Optional) Type a description for the interface.
4. Enable the MAC Loopback Mode slider.
5. Select Next.

   

6. (Optional) Configure Rate Limiting, if required, and select Next.

   

7. Enable the Filter and Delivery radio button.
   Optionally enable the Rewrite VLAN feature.

   Note: The rewrite VLAN ID feature cannot be used with tunneling.
8. Select Save to complete and save the configuration.

1. Select Monitoring > Interfaces > Configuration > Delivery .

   

2. Select (checkbox) a specific interface and select Edit.
3. Select a Rate Limit number and the Bit Rate from the drop-down.

   

4. Select Save.

1. Control the configuration of this feature using Edit by locating the corresponding card and selecting the pencil icon.

   

2. A configuration edit dialogue window pops up, displaying the corresponding prompt message. By default, the Policy Overlap Limit is 4.

   

3. Adjust the Value (minimum value: 0, maximum value: 10). There are two ways to adjust the value:
   • Directly enter the desired value in the input area.
   • Use the up and down arrow buttons in the input area to adjust the value accordingly. Pressing the up arrow increments the value by 1, while pressing the down arrow decrements it by 1.
4. Select Submit to confirm the configuration changes or Cancel to discard the changes.
5. After successfully setting the configuration, the current configuration status displays next to the Pencil (edit) icon.

   

1. Select the Policy Overlap Limit Strict card.
   Note: The Policy Overlap Limit Strict option is enabled by default. The following steps guide if the Policy Overlap Limit Strict option is disabled.

   

2. Toggle the Policy Overlap Limit Strict switch to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

4. Retain Configuring the Policy Overlap Limit Strict is running.

   

5. To disable the feature, toggle the Policy Overlap Limit Strict switch to Off. Select Disable and confirm.

   

   The feature card updates with the status.

   

1. Select a switch and enter the config mode using the following command:

   (config)# switch core1

2. Select an interface on the switch used as the filter-interface, as shown in the following example.

   (config-switch)# interface ethernet1

3. Create a filter interface, for example, f1, using the following command:

   (config-switch-if)# role filter interface-name f1

4. Repeat the process to create the delivery interfaces.

   (config-switch)# interface ethernet2
   (config-switch-if)# role delivery interface-name d1
   (config-switch)# interface ethernet3
   (config-switch-if)# role delivery interface-name d2
   (config-switch)# interface ethernet4
   (config-switch-if)# role delivery interface-name d3

5. Set a max overlap-policy-limit value, for example, 2.

   (config-switch)# overlap-policy-limit 2

6. Create overlap policies using the same filter-interface, in this example, f1.

   (config-switch)# policy p1
   (config-policy)# filter-interface f1
   (config-policy)# delivery-interface d1
   (config-policy)# action forward 
   (config-policy)# 1 match any 
   
   (config-switch)# policy p2
   (config-policy)# filter-interface f1
   (config-policy)# delivery-interface d2
   (config-policy)# action forward 
   (config-policy)# 1 match any

7. Since the overlap-policy-limit value is 2, the third overlap policy will not allow the use of the same filter interface f1 in the third policy, p3. DMF throws a validation error.

   (config-switch)# policy p3
   (config-policy)# delivery-interface d3
   (config-policy)# action forward 
   (config-policy)# filter-interface f1
   Error: Validation failed: Filter interfaces used in more than 2 policies: f1

(config-policy)# show policy
# Policy Name ActionRuntime Status Type Priority Overlap Priority Push VLAN Filter BW (truncated...) 
-|-----------|-------|----------------------------|----------|--------|----------------|---------|--------- (truncated...)
1 _p1_o_p2forward A component policy failedDynamic10013 10Gbps(truncated...) 
2 p1forward all delivery interfaces down Configured 10001 10Gbps(truncated...)
3 p2forward all delivery interfaces down Configured 10002 10Gbps(truncated...)
4 p3forward inactive Configured 10004 - (truncated...)

(config-switch)# policy p3
(config-policy)# inactive
(config-policy)# filter-interface f1

(config-policy)# show running-config policy 
! policy
policy p1
action forward
delivery-interface d1
filter-interface f1
1 match any

policy p2
action forward
delivery-interface d2
filter-interface f1
1 match any

policy p3
action forward
delivery-interface d3
filter-interface f1
inactive
1 match any

1. Select the Monitoring > Rule Groups option.

   

2. On the Rule Groups table, select the + sign to create a new rule group.
3. In the pop-up menu, enter a preferred name for the rule group and, optionally, a description.

   

4. Select NEXT to add specific rules to the rule group.
5. In this pop-up section, add predefined rules by selecting the options provided. In the example below, add a rule to match all IPv4 traffic by selecting IPv4.

   

6. As an alternative to the previous step, add custom rules by selecting the + sign under Rules and adding the necessary fields in the new pop-up screen.

   

7. Complete the dialog that appears to assign a descriptive name to the rule group.
8. Add this rule group to DANZ Monitoring Fabric (DMF) policies as a match condition.

1. When setting the auto VLAN mode to push-per-filter, define the range of automatically assigned VLAN IDs by entering the following command from config mode:

   auto-vlan-range vlan-min start vlan-max end

   Replace start and end with the first and last VLAN ID in the range. For example, the following command assigns a range of 100 VLAN IDs from 3994 to 4094:

   controller-1(config)# auto-vlan-range vlan-min 3994 vlan-max 4094

2. Select the VLAN mode using the following command from config mode:

   auto-vlan-mode command { push-per-filter | push-per-policy }

   Find details of the impact of these options in the Managing VLAN Tags in the Monitoring Fabric section.

   For example, the following command adds a unique outer VLAN tag to each packet received on each filter interface:

   controller-1(config)# auto-vlan-mode push-per-filter
   Switching to auto vlan mode would cause policies to be re-installed. Enter "yes" (or "y")
   to continue: y

3. To display the configured VLAN mode, enter the show fabric command, as in the following example:

   controller-1# show fabric
   ~~~~~~~~~~~~~~~~~~~~~ Aggregate Network State ~~~~~~~~~~~~~~~~~~~~~
   Number of switches: 5
   Inport masking: True
   Start time: 2018-11-02 23:42:29.183000 UTC
   Number of unmanaged services: 0
   Filter efficiency : 1:1
   Number of switches with service interfaces: 0
   Total delivery traffic (bps): 411Kbps
   Number of managed service instances : 0
   Number of service interfaces: 0
   Match mode: full-match
   Number of delivery interfaces : 13
   Max pre-service BW (bps): -
   Auto VLAN mode: push-per-filter
   Number of switches with delivery interfaces : 4
   Number of managed devices : 1
   Uptime: 2 days, 19 hours
   Total ingress traffic (bps) : 550Kbps
   Max overlap policies (0=disable): 10
   Auto Delivery Interface Strip VLAN: False
   Number of core interfaces : 219
   Max filter BW (bps) : 184Gbps
   Number of switches with filter interfaces : 5
   State : Enabled
   Max delivery BW (bps) : 53Gbps
   Total pre-service traffic (bps) : -
   Track hosts : True
   Number of filter interfaces : 23
   Number of active policies : 3
   Number of policies: 25
   ------------------------output truncated------------------------

4. To display the VLAN IDs assigned to each policy, enter the show policy command, as in the following example:

   controller-1> show policy
   # Policy Name Action Runtime Status Type Priority Overlap Priority
   ˓→Push VLAN Filter BW Delivery BW Post Match Filter Traffic Delivery Traffic Services
   -|--------------------------|-------|--------------|----------|--------|----------------|--
   ˓→-------|---------|-----------|-------------------------|----------------|----------------
   ˓→-----|
   1 GENERATE-NETFLOW-RECORDS forward installed Configured 100 0 4
   ˓→ 100Gbps 10Gbps - - DMF-OOB-NETFLOWSERVICE
   2 P1 forward inactive Configured 100 0 1
   ˓→ - 1Gbps - -
   3 P2 forward inactive Configured 100 0 3
   ˓→ - 10Gbps - -
   4 TAP-WINDOWS10-NETWORK forward inactive Configured 100 0 2
   ˓→ 21Gbps 1Gbps - -
   5 TIMESTAMP-INCOMING-PACKETS forward inactive Configured 100 0 5
   ˓→ - 100Gbps - - DMF-OOB-TIMESTAMPINGSERVICE
   controller -1>)#

1. Select the CRC Check card.

   

2. Toggle the CRC Check to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

4. CRC Check is running.

   

5. To disable the feature, toggle the CRC Check to Off. Select Disable and confirm.

   

   The feature card updates with the status.

   

1. Select the Custom Priority card.

   

2. Toggle the Custom Priority to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

4. Custom Priority is running.

   

5. To disable the feature, toggle the Custom Priority to Off. Select Disable and confirm.

   

The feature card updates with the status.

1. Select the Device Deployment Mode card.

   

2. Enter the edit mode using the pencil icon.

   

3. Change the switching mode as required using the drop-down menu. The default mode is Auto Discovery.

   

   

4. Select Submit and confirm the operation when prompted.
5. The Device Deployment Mode status updates.

   

1. Select the Inport Mask card.

   

2. Toggle the Inport Mask to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

4. Inport Mask is running.

   

5. To disable the feature, toggle the Inport Mask to Off. Select Disable and confirm.

   

The feature card updates with the status.

1. Select the Match Mode card.

   

2. Enter the edit mode using the pencil icon.

   

3. Change the switching mode as required using the drop-down menu. The default mode is L3-L4 Match.

   

4. Select Submit and confirm the operation when prompted.

1. Select the Retain User Policy VLAN card.

   

2. Toggle the Retain User Policy VLAN to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

4. Retain User Policy VLAN is running.

   

5. To disable the feature, toggle the Retain User Policy VLAN to Off. Select Disable and confirm.

   

   The feature card updates with the status.

   

1. Select the Tunneling card.

   

2. Toggle Tunneling to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

   Note: CRC Check must be running before attempting to enable Tunneling. An error message displays if CRC Check is not enabled. Proceeding to select Enable results in a validation error message. Refer to the CRC Check section for more information on configuring the CRC Check feature.

   

4. Tunneling VLAN is running.

   

5. To disable the feature, toggle Tunneling to Off. Select Disable and confirm.

   

   The feature card updates with the status.

   

Global Configuration

1. To view or edit the global configuration, navigate to the DANZ Monitoring Fabric (DMF) Features page by selecting the gear icon in the navigation bar.

   

   The DMF Feature allows for managing fabric-wide settings for DMF.
2. Scroll to the VLAN Preservation card.

   

   

3. Select Edit (pencil icon) to configure or modify the global VLAN Preservation feature settings.

   

   The edit screen has two input sections:

   • Toggle on or off the Preserve User Configured VLANs.
   • Enter the parameters for VLAN Preserve using the following functions:
     • Use + Add VLAN to add VLAN IDs.
     • Select the Single VLAN type drop-down to add a single VLAN ID.
     • Select the Range VLAN type drop-down to add a continuous VLAN ID range.
     • Use the Trash icon (delete) to delete a single VLAN ID or a VLAN ID range.
4. Select Submit to save the configuration.

Local Configuration

5. The VLAN Preservation configuration can be applied per-delivery interface while configuring or editing a delivery or filter-and-delivery interface in DMF Interfaces and Monitoring Interfaces > Delivery Interfaces .

   

6. The following inputs are available for the local feature configuration:
   • Enable VLAN Preservation. Use this option to preserve all user-configured VLAN IDs in push-per-policy or push-per-filter mode on a selected delivery interface. The packets with the user-configured VLANs will have their fabric-applied VLAN tags preserved even after leaving the respective delivery interface.
   • Preserve User Configured VLANs. Refer to Step 3.
   • Disable VLAN Preservation. Disabling this option will ignore this feature configuration given globally/locally for this delivery interface. VLAN Preservation is enabled by default.
7. Select Save to save the configuration.

VLAN Preservation for MLAG Delivery Interfaces

8. Configure VLAN preservation for MLAG delivery interfaces using the FabricMLAGs page while configuring an MLAG Domain toggling the VLAN Preservation and Preserve User Configured VLANs switches to on (as required).

   

   

1. A partial policy installation may occur if any delivery interface fails to preserve the VLAN tag. This can happen when exceeding the 2000 VLAN ID/Port combination limit. Use the show policy policy-name command to obtain a detailed status, as shown in the following example:

   (config)# show policy vlan-999
   Policy Name: vlan-999
   Config Status: active - forward
   Runtime Status : installed but partial failure
   Detailed Status: installed but partial failure - 
    Failed to preserve VLAN's on some/all 
    delivery interfaces, see warnings for details
   Priority : 100
   Overlap Priority : 0
   # of switches with filter interfaces : 1
   # of switches with delivery interfaces : 1
   # of switches with service interfaces: 0
   # of filter interfaces : 1
   # of delivery interfaces : 1
   # of core interfaces : 2
   # of services: 0
   # of pre service interfaces: 0
   # of post service interfaces : 0
   Push VLAN: 999
   Post Match Filter Traffic: -
   Total Delivery Rate: -
   Total Pre Service Rate : -
   Total Post Service Rate: -
   Overlapping Policies : none
   Component Policies : none
   Installed Time : 2023-11-06 21:01:11 UTC
   Installed Duration : 1 week

2. Verify the running config and review if the VLAN preservation configuration is enabled for that VLAN ID and on that delivery interface.

   (config-vlan-preservation)# show running-config | grep "preserve"
   ! vlan-preservation
   vlan-preservation
   preserve-vlan 100

3. Verify the show switch switch-name table vlan-preserve output. It displays the ports and VLAN ID combinations that are enabled.

   (config-policy)# show switch core1 table vlan-preserve
   # Vlan-preserve Device name Entry key
   -|-------------|-----------|----------------------|
   1 0 core1 VlanVid(0x64), Port(6)

4. The same configuration can be verified from a switch (e.g., core1) by using the command below:

   root@core1:~# ofad-ctl gt vlan_preserve
   VLAN PRESERVE TABLE:
   --------------------
   VLAN:100Port:6PortClass:6

5. Verify if a switch has any associated preserve VLAN warnings among the fabric warnings:

   (config-vlan-preservation)# show fabric warnings | grep "preserve
   1 delivery1 (00:00:52:54:00:85:ca:51) Switch 00:00:52:54:00:85:ca:51 
   cannot preserve VLANs for some interfaces due to resource exhaustion.

6. The show fabric warnings feature-unsupported-on-device command provides information on whether VLAN preservation is configured on any unsupported devices:

   (config-switch)# show fabric warnings feature-unsupported-on-device 
   # Name Warning
   -|----|------------------------------------------------------------|
   1 del1 VLAN preservation feature is not supported on EOS switch eos

1. From config mode, specify the switch to be configured with dual management, as in the following example:

   Controller-1(config)# switch DMF-SWITCH-1
   Controller-1(config-switch)#

   The CLI changes to the config-switch submode, to configure the specified switch.

2. From config-switch mode, enter the interface command to specify the interface to be configured as the standby management interface:

   Controller-1(config-switch)# interface ethernet40
   Controller-1(config-switch-if)#

   The CLI changes to the config-switch-if submode, to configure the specified interface.

3. From config-switch-if mode, enter the management command to specify the role for the interface:

   Controller-1(config-switch-if)# management
   Controller-1(config-switch-if)#

1. Select Fabric > Switches from the main menu.

   

2. Select the switch name to be configured with dual management.

   

3. Select the Interfaces tab.

   

4. Identify the interface to be configured as the standby management interface.

   

5. Select Menu to the left of the identified interface, then select Configure.

   

6. Set Use for Management Traffic to Yes. This action configures the interface to the standby management role.

   

7. Select Save.

1. Navigate to Monitoring > Interfaces .

   

2. Under the Configuration tab select either Delivery or Filter & Delivery.
   Note: DMF supports configuring egress filtering rules for Delivery, Filter & Delivery, and Recorder Node interfaces.

   

3. Optional - If required, create a Delivery or Filter & Delivery interface using Create DMF Interface.

   

4. Under the DMF Interface Name, select the Delivery or Filter & Delivery interface to configure additional interface attributes.

   

5. Under Configuration, select + Add Rule in the Egress Filtering Rules section.

   

6. Setting EtherType to either IPv4 or IPv6 displays additional configuration options.
   • Traffic: Basic traffic configurations.
     • Sequence - Enter a numerical value. The lowest sequence number will have the highest priority.
     • Action (drop-down) - Allow or Drop
     • Ethertype (drop-down) - IPv4, IPv6, or Any
   • Source: Single IP or IP Range.
     • IP Address
     • IP Mask
   • Destination: Single IP or IP Range.
     • IP Address
     • IP Mask
   • VLANs: VLAN (drop-down) - Any, Single, or Range.

   

7. Enter all required inputs, and any optional fields that are applicable. Select Submit to save the Egress Filtering Rule.
8. Repeat the process using + Add Rule to add more rules as needed.

   

9. To edit a rule, click the pencil (edit) icon. To delete a rule, select the trash (delete) icon.

Similarly, to configure Egress filtering rules for Recorder Node Interfaces, navigate to Monitoring > Recorder Nodes . Under the Inventory section, select RN Interfaces and the RN interface name to configure the egress filtering rules.

1. Review the show running-config command output to see if the egress filtering rules are configured correctly under that particular interface.
2. Verify the show switch switch-name table egress-flow-1 command output. It will display the port number of the interface for the configured egress filtering rules, its qualifiers as Entry key, the Entry value action of Drop or NoDrop, and a default drop rule for that port number with priority 0.

   dmf-controller# show sw all table egress-flow-1 
   # Egress-flow-1 Device nameEntry key Entry value 
   -|-------------|-----------------|---------------------------------------------------------------|---------------------------------------------|
   1 0 DCS-7050SX3-48YC8 Priority(1000), Port(13), EthType(2048), Ipv4Src(12.123.123.12) Name(__Rule1__), Data([0, 0, 0, 0]), NoDrop()
   2 1 DCS-7050SX3-48YC8 Priority(0), Port(13) Name(__Rule0__), Data([0, 0, 0, 0]), Drop()

3. Use the following command to verify the same information from a switch (e.g., DCS-7050SX3-48YC8).

   root@DCS-7050SX3-48YC8:~# ofad-ctl gt egr_flow1
   GENTABLE : egr_flow1
   GENTABLE ID : 0x0019
   Table count: matched/lookup : 0/0
   Entry count/limit : 2/1024
   guaranteed max: 512, potential max: 1024
   priority 0 out_port 13drop true0p/0b eid 17
   priority 1000 out_port 13 eth_type 0x800/0xffff ipv4_src 12.123.123.12/255.255.255.255drop false0p/0b eid 22

4. Use the show fabric warnings egress-filtering-warning command to view any egress filtering warnings.

   dmf-controller(config)# show fabric warnings egress-filtering-warning 
   ~~~~~~~~~~~~~~~~~~~~~~~~~ Egress filtering warnings ~~~~~~~~~~~~~~~~~~~~~~~~~
   # Switch IF Name Warning message
   -|-----------------|-----------|-----------------------------------------------------|
   1 DCS-7050SX3-48YC8 ethernet18Supported only on delivery or recorder node interfaces
   2 DCS-7280SR-48C6 Ethernet8 Egress filtering feature is not supported on EOS switches

5. The show fabric warnings feature-unsupported-on-device command provides information on any egress filtering rules configured on any unsupported devices:

   dmf-controller(config)# show fabric warnings feature-unsupported-on-device 
   # NameWarning
   -|-------|------------------------------------------------------------|
   1 test1 Egress filtering is not supported on the switch test1

1. (For ERSPAN only) Define the tunnel endpoint.
   Identify a fabric interface connected to the vCenter instance for the tunnel endpoint by entering the tunnel-endpoint command in config mode. To define the tunnel endpoint, refer to the Defining a Tunnel Endpoint section.
2. Provide the vCenter address and credentials.

   The vSphere extension on the DANZ Monitoring Fabric (DMF) Controller discovers an inventory of VMs and the associated details for each VM.

3. Select the VMs to monitor on the DMF Controller.

   The DMF Controller uses APIs to invoke the vSphere vCenter instance.

   vSphere calls the DVS to create a SPAN session. The preferred option is to SPAN on a separate physical NIC. However, the option exists to also use ERSPAN by tunneling to the remote interface.

4. Create policies in DMF to filter, replicate, process, and redirect traffic to tools.

   When using tunnels with ERSPAN, DMF terminates the tunnels using the specified tunnel endpoint. A DMF policy for monitoring VM traffic using a SPAN session must include the required information regarding the vCenter configuration. All match conditions, including User-Defined ofFsets (UDFs), are supported.

   The policy for selecting VM traffic to monitor is similar to other DMF policies, except that the filtering interfaces are orchestrated automatically (filter interfaces are auto-discovered and cannot be specified manually). All managed-service actions are supported.

1. Enable the mirror stack in the ESXi host if not already enabled.
   1. Use the esxcli network ip netstack list command to review the current network stacks.

      [root@ESX33:~] esxcli network ip netstack list
      defaultTcpipStack
       Key: defaultTcpipStack
       Name: defaultTcpipStack
       State: 4660
      
      mirror
       Key: mirror
       Name: mirror
       State: 4660

      To view the TCP/IP configuration from vCenter UI, navigate to Host > Configure > TCP/IP .

      

   2. If the mirror stack is not configured, use the esxcli network ip netstack set -N mirror command to enable it.
      Note: The mirror setting is required to enable the Mirror TCP/IP stack and DMF integration.
2. From vCenter create a VMkernel adapter with the mirror stack.

   

   Select the appropriate network using the Browse option.

   

   Select Next and select Port properties and choose mirror.

   

   

   Add the IPv4 address and the Default gateway address according to your local network requirements.

   

   Select Next.

   

3. Based on the networking requirements, configure the default gateway of the mirror stack in the host's TCP/IP configuration or a static route entry in the ESXi host to the DMF tunnel endpoint. The following example illustrates adding a static route entry to the DMF tunnel endpoint.

   [root@ESX33:~] esxcli network ip route ipv4 add -n 192.168.200.0/24-g 192.168.150.1 -N mirror
   
   [root@ESX31:~] esxcli network ip route ipv4 list -N mirror
   NetworkNetmaskGatewayInterfaceSource
   ------------------------------------------------------
   192.168.150.0255.255.255.00.0.0.0vmk2 MANUAL
   192.168.200.0255.255.255.0192.168.150.1vmk2 MANUAL

4. Navigate to Configure > TCP/IP Configuration > Select mirror stack > IPv4 Routing Table to view the routes.

   

   

1. Connect switch ports (on remote and main datacenter) to their respective WAN routers and ensure they can communicate via IP.
2. Enable tunneling on the DMF network by entering the following command from config mode:

   controller-1(config)# tunneling
   Tunneling is an Arista Licensed feature. Please ensure that you have purchased the license
   for tunneling before using this feature. enter "yes" (or "y") to continue: yes
   controller-1(config)#

3. Configure the MAC loopback mode, as shown in the following example:

   controller-1(config)# switch DMF-CORE-SWITCH
   controller-1(config-switch)# interface ethernet7
   controller-1(config-switch-if)# loopback-mode mac

4. Create tunnel endpoints.

!
switch remote-dc1-filter-sw
gre-tunnel-interface tunnel1
remote-ip 192.168.200.50
gre-key-decap 4097 === 4097 is the VPN key used for the tunnel ID
parent-interface ethernet6
local-ip 192.168.100.50 mask 255.255.255.0 gateway-ip 192.168.100.1
direction bidirectional encap-loopback-interface ethernet38
!
switch main-dc-delivery-sw
gre-tunnel-interface tunnel1
remote-ip 192.168.100.50
gre-key-decap 4097 === 4097 is the VPN key used for the tunnel ID
parent-interface ethernet5
local-ip 192.168.200.50 mask 255.255.255.0 gateway-ip 192.168.200.1
direction bidirectional encap-loopback-interface ethernet3

!
switch remote-dc1-filter-sw
gre-tunnel-interface tunnel1
remote-ip 192.168.200.50
gre-key-decap 4097 === 4097 is the VPN key used for the tunnel ID
interface parent-interface ethernet6
local-ip 192.168.100.50 mask 255.255.255.0 gateway-ip 192.168.100.1
direction transmit-only encap-loopback-interface ethernet38
!
switch main-dc-delivery-sw
gre-tunnel-interface tunnel1
remote-ip 192.168.100.50
gre-key-decap 4097 === 4097 is the VPN key used for the tunnel ID
parent-interface ethernet5
local-ip 192.168.200.50 mask 255.255.255.0 gateway-ip 192.168.200.1
direction receive-only

1. Connect switch ports (on remote and main datacenter) to their respective WAN routers and ensure that they can communicate via IP.
2. Enable tunneling on the DMF network by entering the following command from config mode:

   controller-1(config)# tunneling
   Tunneling is an Arista Licensed feature. Please ensure that you have purchased the license
   for tunneling before using this feature. enter "yes" (or "y") to continue: yes
   controller-1(config)#

3. Configure the MAC loopback mode, as shown in the following example:

   controller-1(config)# switch DMF-CORE-SWITCH
   controller-1(config-switch)# interface ethernet7
   controller-1(config-switch-if)# loopback-mode mac

4. Create tunnel endpoints.

!
switch remote-dc1-filter-sw
vxlan-tunnel-interface tunnel1
remote-ip 192.168.200.50
parent-interface ethernet6
local-ip 192.168.100.50 mask 255.255.255.0 gateway-ip 192.168.100.1
direction bidirectional encap-loopback-interface ethernet38
!
switch main-dc-delivery-sw
vxlan-tunnel-interface tunnel1
remote-ip 192.168.100.50
parent-interface ethernet5
local-ip 192.168.200.50 mask 255.255.255.0 gateway-ip 192.168.200.1
direction bidirectional encap-loopback-interface ethernet3

!
switch remote-dc1-filter-sw
vxlan-tunnel-interface tunnel1
remote-ip 192.168.200.50
interface parent-interface ethernet6
local-ip 192.168.100.50 mask 255.255.255.0 gateway-ip 192.168.100.1
direction transmit-only encap-loopback-interface ethernet38
!
switch main-dc-delivery-sw
vxlan-tunnel-interface tunnel1
remote-ip 192.168.100.50
parent-interface ethernet5
local-ip 192.168.200.50 mask 255.255.255.0 gateway-ip 192.168.200.1
direction receive-only

1. Enable the tunneling feature before configuring tunnels on a switch using the tunneling command. Enter yes when prompted to continue.

   dmf-controller-1(config)# tunneling
   Tunneling is an Arista Licensed feature. 
   Please ensure that you have purchased the license for tunneling before using this feature.
   Enter "yes" (or "y") to continue: y
   dmf-controller-1(config)#

2. Configure a tunnel by using the remote-ip as 0.0.0.0.

   dmf-controller-1(config)# switch main-dc-delivery-sw
   dmf-controller-1(config-switch)# gre-tunnel-interface tunnel1
   dmf-controller-1(config-switch)# remote-ip 0.0.0.0 === this is to enable wildcard tunnel
   dmf-controller-1(config-switch)# gre-key-decap 4097
   dmf-controller-1(config-switch)# parent-interface ethernet5
   dmf-controller-1(config-switch)# local-ip 192.168.200.50 mask 255.255.255.0 gateway-ip 192.168.200.1
   dmf-controller-1(config-switch)# direction receive-only

dmf-controller-1# show tunnel
# Switch DPID Tunnel Name Tunnel StatusDirection Src IP Dst IP Parent NameLoopback Name
-|-----------------|-----------|------------------|-------------|------------|------------|------------|-------------|
1 DMF-CORE-SWITCH-1 tunnel1 ESTABLISHED_TUNNEL bidirectional 198.82.215.1 216.47.143.1 ethernet5:1ethernet6
2 DMF-CORE-SWITCH-2 tunnel1 ESTABLISHED_TUNNEL bidirectional 216.47.143.1 198.82.215.1 ethernet11:3 ethernet5
3 DMF-CORE-SWITCH-2 tunnel2 ESTABLISHED_TUNNEL bidirectional 192.168.43.1 192.168.42.1 ethernet11:4 ethernet17
4 DMF-CORE-SWITCH-3 tunnel2 ESTABLISHED_TUNNEL bidirectional 192.168.42.1 192.168.43.1 ethernet6ethernet33

1. Configure the L2 GRE Key Hashing in the UI for a switch in the Fabric > Switches page using the table row menu action Configure option.

   

2. Enable the L2 GRE Key for the IPv4 packets in the LAG Enhanced Hash step.
   Note: The L2 GRE Key is unsupported for IPv6 and VXLAN Inner L3.

   

3. Select Submit to save the configuration.

1. Configure the VXLAN Hashing in the UI for a switch in the Fabric > Switches page using the table row menu action Configure option.

   

2. In the LAG Enhanced Hash step, configure the following fields depending on your requirements:
   • L2 VXLAN Inner L2 fields
   • VXLAN Inner L3 fields
   Note:

   • L2 GRE Key is not supported for VXLAN hash fields.
   • Cannot simultaneously specify enhanced hash for L2 GRE Inner L2 and Inner L3.
   • Cannot simultaneously specify enhanced hash for VXLAN Inner L2 and Inner L3.

   

3. Select Submit to save the configuration.

1. Use the lag-interface command to enter the config-switch-lag-if submode to define the LAG member interfaces and specify the type of load distribution (hashing) to use for the LAG.
2. Use the member command to add an interface to a LAG. Enter this command for each interface to add to the LAG. To remove an interface, use the no member version of the command.
   For example, the following commands add two interfaces to a LAG named my-lag.

   controller-1(config)# switch DMF-FILTER-SWITCH-1
   controller-1(config-switch)# lag-interface mylag
   controller-1(config-switch-lag-if)# member ethernet13
   controller-1(config-switch-lag-if)# member ethernet14

3. To configure multiple delivery interfaces as a LAG, complete the following steps:
   1. Assign a name to the LAG and enter the config-switch-lag-if submode.

      controller-1(config)# switch DMF-DELIVERY-SWITCH-1
      controller-1(config-switch)# lag-interface lag1
      controller-1(config-switch-lag-if)#

   2. Assign members to the LAG.

      controller-1(config-switch-lag-if)# member ethernet39
      controller-1(config-switch-lag-if)# member ethernet40

4. To configure a core LAG apply the membership configuration to both ends of the connection:

   controller-1(config)# switch SWITCH-1
   controller-1(config-switch)# lag-interface core-link
   controller-1(config-switch-lag-if)# member ethernet1
   controller-1(config-switch-lag-if)# member ethernet3

   controller-1(config)# switch SWITCH-2
   controller-1(config-switch)# lag-interface core-link
   controller-1(config-switch-lag-if)# member ethernet49
   controller-1(config-switch-lag-if)# member ethernet51

    

   Note: Ensure that when you set up a core LAG between DMF fabric switches it is properly configured on both sides of the connection; otherwise, you will get a lag_misconfiguration error state. You need to configure link aggregation symmetrically on both ends of a connection for it to work properly.

    

5. To view the configured LAGs, enter the show lag command, as in the following example:

   controller-1> show lag
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lag Interfaces~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   # Switch LAG State Rx Rate Pkt Rate Peak Rate Peak Pkt Rate TX Rate Pkt Rate Peak Rate Peak Pkt Rate 
   -|--------|---------|-----|-------|--------|---------|-------------|-------|--------|---------|-------------|
   1 SWITCH-1 core-link up720bps02.59Gbps608181184bps053.2Mbps37150
   2 SWITCH-2 core-link up184bps0424bps0 720bps01.08Kbps1
   
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Member Interfaces~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   # Switch LAG Member State Fault Rx Rate Pkt Rate Peak Rate Peak Pkt Rate Tx Rate Pkt Rate Peak Rate Peak Pkt Rate 
   -|--------|---------|----------|-----|-----|-------|--------|---------|-------------|-------|--------|---------|-------------|
   1 SWITCH-1 core-link ethernet1up624bps0800bps1 88bps 0152bps0
   2 SWITCH-1 core-link ethernet3up96bps 018.5Mbps173588bps 0136bps0
   3 SWITCH-2 core-link ethernet49 up88bps 0152bps0 624bps0800bps1
   4 SWITCH-2 core-link ethernet51 up88bps 0280bps0 96bps 018.5Mbps1735

1. Configure an MLAG domain by specifying an alias, and add peer switches that will be participating in the MLAG.

   Controller-1(config)# mlag-domain MLAG-Domain1
   Controller-1(config-mlag-domain)# peer-switch DeliverySwitch-1
   Controller-1(config-mlag-domain)# peer-switch DeliverySwitch-2

2. Configure the core MLAG interface.

   Controller-1(config-mlag-domain)# mlag-interface MLAG-Core-Intf
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-1 interface ethernet50
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-2 interface ethernet50

   The above MLAG interface configuration selects one physical interface from each peer switch added into the MLAG domain. This MLAG interface is fabric-facing, which means that ethernet50 of DeliverySwitch-1 and ethernet50 of DeliverySwitch-2 are connected to the DMF core switch, where traffic hashing is performed.

3. Configure the core LAG interface, a LAG interface on the core switch. The members of the LAG interface are connected to the peer switches in the MLAG domain. This configuration ensures that the traffic will be hashed toward the two connected delivery switches.

   Controller-1(config)# switch CoreSwitch-1
   Controller-1(config-switch)# lag-interface Core-LAG
   Controller-1(config-switch-lag-if)# member ethernet10
   Controller-1(config-switch-lag-if)# member ethernet20

4. Configure the delivery MLAG interface by specifying an interface alias and selecting one member from each delivery switch.

   Controller-1(config-mlag-domain-if)# mlag-interface MLAG-Del-Intf
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-1 interface ethernet1
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-2 interface ethernet1
   Controller-1(config-mlag-domain-if)# role delivery interface-name MLAG-Tool-1

   The above MLAG interface configuration selects one physical interface from each peer switch added into the MLAG domain. The members of this MLAG interface, ethernet1 of DeliverySwitch-1 and ethernet1 of DeliverySwitch-2, are connected to multi-homed tools. Note that unlike the core MLAG interface, the delivery MLAG interface is assigned the delivery role and its interface name is configured, so that it can be used in DMF policies as a delivery interface.

5. Configure a DMF policy by following the procedure shown below:

   Controller-1(config)# policy Policy-1
   Controller-1(config-policy)# action forward
   Controller-1(config-policy)# 1 match any
   Controller-1(config-policy)# filter-interface Filter-1
   Controller-1(config-policy)# delivery-interface MLAG-Tool-1

   The above policy is configured using the MLAG-Tool-1 interface configured in Step 4. Configuring the policy to use an MLAG delivery interface will result in two dynamic policies, one for each peer switch. Refer to the following topology for the policy breakdown.

   

As seen in the topology above:

• The user-configured policy delivers traffic from the filter switch to the core switch LAG interface.
• Dynamic Policy 1 delivers traffic to delivery switch 1.
• Dynamic Policy 2 delivers traffic to delivery switch 2.

The following output displays the three policies as configured on the DMF controller:

Below are the details for each policy:

Policy: Policy-1 Interfaces

• Filter Interface(s) section lists the filter interface configured for the policy, Policy-1.
• Core Interface(s) section lists the interfaces that connect the filter switch and the core switch selected for the policy.
• MLAG Core Interface(s) section displays the core LAG interface that hashes the traffic towards the peer switches.
• MLAG Delivery Interface(s) section lists the delivery MLAG interface members.

Policy: _mlag_Policy-1_DeliverySwitch-1 Interfaces

• Filter Interfaces(s) section lists the dynamically configured interface name on DeliverySwitch1 to which the core switch is connected.
• MLAG Delivery Interface(s) section lists the delivery MLAG interface member on DeliverySwitch1.

Policy: _mlag_Policy-1_DeliverySwitch-2 Interfaces

• Filter Interfaces(s) section lists the dynamically configured interface name on DeliverySwitch2 to which the core switch is connected.
• MLAG Delivery Interface(s) section lists the delivery MLAG interface member on DeliverySwitch2.

1. Configure the LAG interface on Peer Switch 1.

   Controller-1(config)# switch DeliverySwitch-1
   Controller-1(config-switch)# lag-interface LAG-peer-switch-1
   Controller-1(config-switch-lag-if)# member ethernet11
   Controller-1(config-switch-lag-if)# member ethernet12

2. Configure the LAG interface on Peer Switch 2.

   Controller-1(config)# switch DeliverySwitch-2
   Controller-1(config-switch)# lag-interface LAG-peer-switch-2
   Controller-1(config-switch-lag-if)# member ethernet11
   Controller-1(config-switch-lag-if)# member ethernet12

3. Add the configured LAG interfaces as members into the MLAG interface.

   Controller-1(config)# mlag-domain Domain1
   Controller-1(config-mlag-domain)# mlag-interface MLAG-LAG-Del-Intf
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-1 interface LAG-peer-switch-1
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-2 interface LAG-peer-switch-2
   Controller-1(config-mlag-domain-if)# role delivery interface-name MLAG-LAG-Tool-1

4. Configure the DMF policy using the delivery interface MLAG-LAG-Tool-1.

   Controller-1(config)# policy Policy-1
   Controller-1(config-policy)# action forward
   Controller-1(config-policy)# 1 match any
   Controller-1(config-policy)# filter-interface Filter-1
   Controller-1(config-policy)# delivery-interface MLAG-LAG-Tool-1

   Note: Traffic will not hash toward tools if the core switch LAG has the same number of member interfaces as the LAG on the peer switches of MLAG delivery.

   Workaround:

   • Ensure that the hash fields on the core switch and MLAG peer switches are different or:
   • Ensure that the number of member interfaces in the LAG interface configured on the core switch differs from the number of members in the LAG interface configured on peer switches.

1. Select Monitoring > Recorder Nodes from the main menu bar of the DANZ Monitoring Fabric (DMF) GUI.

   

2. To add a new RN, select the Add Recorder Node (Recorder Nodes tab active) in the Inventory section.

   

3. Enter the following information in the required fields:
   • Assign a name to the RN.
   • Set the MAC Address of the RN. Obtain the MAC address from the chassis ID of the connected device, using the Fabric > Connected Devices .

     

4. Configure the following options as needed:
   • Recording: Recording is enabled by default. To disable recording on the RN, move the Recording toggle switch to Off. When recording is enabled, the RN records the matching traffic directed from the filter interface defined in a DMF policy.
   • Disk Full Policy: The default packet removal policy is Continuous operating as FIFO (First In First Out), which means the oldest packets are deleted to make room for newer packets. This occurs only when the RN disks are full. The alternative removal policy is Stop, which causes the RN to stop recording when the disks are full and wait until disk space becomes available. Disk space can be made available by leveraging the RN delete operation to remove all or selected time ranges of recorded packets.
   • Backup Disk Policy: Specify the disk backup policy to as desired. Select from one of the three following options:
     • No Backup: This is the default option and is also the recommended option when no extra disk is available.
     • Remote Extend: In this option, recording is performed on the local disks. When full, the recording continues on a remote Isilon cluster mounted over NFS. In this mode, the remote disks are called backup disks. With regard to the Disk Full Policy, if set to:
       • Stop: Recording stops when both local and remote disks become full.
       • Continuous: When the configured threshold is reached, the oldest files from both disks are removed until the disk usage returns below the threshold number.
     • Local Fallback: In this option, recording is performed on a remote Isilon cluster mounted over NFS. If the connection between the Recorder Node and the remote cluster fails, the recording is performed on the local disks until the failure is resolved. In this mode, the local disks are called backup disks. With regard to the Disk Full Policy, if set to:
       • Stop: Recording stops when the remote disks become full.
       • Continuous: When the configured threshold is reached, the oldest files from both disks are removed until the disk usage returns below the threshold number.
     Note: A connection failure should not occur due to a misconfiguration of the NFS server on the DMF Controller. In such cases, the recording stops until the Controller’s configuration is fixed.
   • Max Packet Age: Change the Max Packet Age to set the maximum number of minutes that recorded packets are kept on the RN. Packets recorded are discarded after the specified number of minutes. This defines the maximum age in minutes of any packet in the RN. It can be used in combination with the Disk Full Policy to control when packets are deleted based on age rather than disk utilization alone. When unset, Max Packet Age is not enforced.
   • Incident Look Ahead Buffer: Assign the number of minutes the RN pre-buffer allows for windowed retention of packets received by the RN for a specified length of time. By default, the Incident Look Ahead Buffer is set to zero minutes (disabled). With a nonzero Incident Look Ahead Buffer setting and triggering a recorder event, any packets in the pre-buffer are saved to disk, and any packets received by the recorder after the trigger are saved directly to disk. When terminating an ongoing recorder event, a new pre-buffer is established in preparation for the next event.
   • Max Disk Utilization: Specify the maximum utilization allowed on the index and packet disks. The Disk Full Policy is enforced at this limit. If left unset, then the disks space are used to capacity.
   • Parse MetaWatch Trailer: Determine the parsing of the MetaWatch trailer.
     • Off: When set to Off, the RN will not parse the MetaWatch trailer, even if it is present in incoming packets.
     • Auto: When set to Auto, the RN will look for a valid timestamp in the last 12 bytes of the packet. If it matches the system timestamp closely enough, the trailer is parsed by the RN.
     • Always: When set to Always, RN will assume the last 12 bytes of packet is a MetaWatch trailer and parse it, even if it did not find a valid timestamp.
   • Indexing: All the indexing options are enabled by default. To disable any of the indexing behaviors, select Indexing and deselect from the list, as required. These include:
     • MAC Source
     • MAC Destination
     • VLAN 1
     • VLAN 2
     • VLAN 3
     • IPv4 Source
     • IPv4 Destination
     • IPv6 Source
     • IPv6 Destination
     • IP Protocol
     • Port Source
     • Port Destination
     • MPLS
     • Community ID
     • MetaWatch Device ID
     • MetaWatch Port ID

     For more details, see the Indexing Configuration section.

5. Configure network and storage settings selecting Network & Storage Config.
   In order to store packets on external storage using an NFS mount, connect the Recorder Node's (RN) auxiliary interface to the same network and subnet where the NFS storage resides, as displayed in the figure below.

   

   Note: Create the volume for the index and packet on the NFS storage first. Refer to the vendor-specific NFS storage documentation about creating the volume (or path).

   

   1. Auxiliary NIC Configuration: Move the toggle switch to On.
      Enter the IP Address and Mask. These are required fields.

      

   2. Index Disk Configuration: Move the toggle switch to On.
      Enter the NFS Server as an IP address or hostname. For external NFS storage, such as Isilon, connect the auxiliary interface of the RN to a network and subnet that is reachable to Isilon NFS storage. When recording to an Isilon cluster over NFS with SmartConnect, the name of the storage pool can be specified. SmartConnect requires this name be registered as an A record pointing to the SmartConnect VIP in the DNS server used by the recorder node. The recorder will establish many mount points to the provided volume name in this storage pool. Each mount point will resolve to a different node in the storage pool, allowing the recorder to distribute recorded packets and metadata across multiple nodes in parallel.
      Enter the Volume: Specify the storage location or path on the NFS server for the Index Disk.
      Enter the Transport Port of NFS Service details. DMF uses the default value (2049) if no value is specified. Specify a value if the NFS storage has been configured to use something other than the default value.

      

   3. Packet Disk Configuration: Move the toggle switch to On.
      Enter the NFS Server as an IP address or hostname. For external NFS storage, such as Isilon, connect the auxiliary interface of the RN to a network and subnet that is reachable to Isilon NFS storage. When recording to an Isilon cluster over NFS with SmartConnect, the name of the storage pool can be specified. SmartConnect requires this name be registered as an A record pointing to the SmartConnect VIP in the DNS server used by the recorder node. The recorder will establish many mount points to the provided volume name in this storage pool. Each mount point will resolve to a different node in the storage pool, allowing the recorder to distribute recorded packets and metadata across multiple nodes in parallel.
      Enter the Volume: Specify the storage location or path on the NFS server for the Packet Disk.
      Enter the Transport Port of NFS Service details. DMF uses the default value (2049) if no value is specified. Specify a value if the NFS storage has been configured to use something other than the default value.

      

6. Select Add Recorder Node to save and close the configuration page.