1. Display the available interfaces by selecting Fabric > Interfaces .
   The system displays the Interfaces page, which lists the interfaces connected to the DANZ Monitoring Fabric (DMF) fabric.

   

2. Select the Menu control for the interface to use and select Configure from the pull-down menu.
   The system displays the following dialog:

   

3. (Optional) Type a description for the interface.
4. Enable the MAC Loopback Mode slider.
5. Select Next.

   

6. (Optional) Configure Rate Limiting, if required, and select Next.

   

7. Enable the Filter and Delivery radio button.
   Optionally enable the Rewrite VLAN feature.

   Note: The rewrite VLAN ID feature cannot be used with tunneling.
8. Select Save to complete and save the configuration.

1. Select Monitoring > Interfaces > Configuration > Delivery .

   

2. Select (checkbox) a specific interface and select Edit.
3. Select a Rate Limit number and the Bit Rate from the drop-down.

   

4. Select Save.

1. Control the configuration of this feature using Edit by locating the corresponding card and selecting the pencil icon.

   

2. A configuration edit dialogue window pops up, displaying the corresponding prompt message. By default, the Policy Overlap Limit is 4.

   

3. Adjust the Value (minimum value: 0, maximum value: 10). There are two ways to adjust the value:
   • Directly enter the desired value in the input area.
   • Use the up and down arrow buttons in the input area to adjust the value accordingly. Pressing the up arrow increments the value by 1, while pressing the down arrow decrements it by 1.
4. Select Submit to confirm the configuration changes or Cancel to discard the changes.
5. After successfully setting the configuration, the current configuration status displays next to the Pencil (edit) icon.

   

1. Select the Policy Overlap Limit Strict card.
   Note: The Policy Overlap Limit Strict option is enabled by default. The following steps guide if the Policy Overlap Limit Strict option is disabled.

   

2. Toggle the Policy Overlap Limit Strict switch to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

4. Retain Configuring the Policy Overlap Limit Strict is running.

   

5. To disable the feature, toggle the Policy Overlap Limit Strict switch to Off. Select Disable and confirm.

   

   The feature card updates with the status.

   

1. Select a switch and enter the config mode using the following command:

   (config)# switch core1

2. Select an interface on the switch used as the filter-interface, as shown in the following example.

   (config-switch)# interface ethernet1

3. Create a filter interface, for example, f1, using the following command:

   (config-switch-if)# role filter interface-name f1

4. Repeat the process to create the delivery interfaces.

   (config-switch)# interface ethernet2
   (config-switch-if)# role delivery interface-name d1
   (config-switch)# interface ethernet3
   (config-switch-if)# role delivery interface-name d2
   (config-switch)# interface ethernet4
   (config-switch-if)# role delivery interface-name d3

5. Set a max overlap-policy-limit value, for example, 2.

   (config-switch)# overlap-policy-limit 2

6. Create overlap policies using the same filter-interface, in this example, f1.

   (config-switch)# policy p1
   (config-policy)# filter-interface f1
   (config-policy)# delivery-interface d1
   (config-policy)# action forward 
   (config-policy)# 1 match any 
               
   (config-switch)# policy p2
   (config-policy)# filter-interface f1
   (config-policy)# delivery-interface d2
   (config-policy)# action forward 
   (config-policy)# 1 match any

7. Since the overlap-policy-limit value is 2, the third overlap policy will not allow the use of the same filter interface f1 in the third policy, p3. DMF throws a validation error.

   (config-switch)# policy p3
   (config-policy)# delivery-interface d3
   (config-policy)# action forward 
   (config-policy)# filter-interface f1
   Error: Validation failed: Filter interfaces used in more than 2 policies: f1

(config-policy)# show policy
# Policy Name Action  Runtime Status               Type       Priority Overlap Priority Push VLAN Filter BW (truncated...) 
-|-----------|-------|----------------------------|----------|--------|----------------|---------|--------- (truncated...)
1 _p1_o_p2    forward A component policy failed    Dynamic    100      1                3         10Gbps    (truncated...) 
2 p1          forward all delivery interfaces down Configured 100      0                1         10Gbps    (truncated...)
3 p2          forward all delivery interfaces down Configured 100      0                2         10Gbps    (truncated...)
4 p3          forward inactive                     Configured 100      0                4         -         (truncated...)

(config-switch)# policy p3
(config-policy)# inactive
(config-policy)# filter-interface f1

(config-policy)# show running-config policy 
! policy
policy p1
action forward
delivery-interface d1
filter-interface f1
1 match any
                
policy p2
action forward
delivery-interface d2
filter-interface f1
1 match any
                
policy p3
action forward
delivery-interface d3
filter-interface f1
inactive
1 match any

In this release, the Rule Groups Dashboard aligns with modern User Interface (UI) standards used throughout DMF. This view maintains full functional parity with the previous version while delivering a consistent and unified user experience.

Access Rule Groups through the main navigation menu under Monitoring.

The dashboard presents a tabular view of all configured rule groups.

Follow the steps outlined in the following content to manage rule groups and rules (Create, Import, Edit, or Delete):

1. From the Rules Group dashboard select + Create Rule Group.

   

   Note: The workflows within this drawer align with the Policies dashboard to ensure a consistent user experience. Use the controls Import Rules and + Add Rule to add or import individual rules.
2. To add a Single Rule, select Add Rule.
   1. Populate the applicable fields in the configuration form including a Name and an optional Description. Use the Additional Configurations drop-down to enter parameters related to the chosen traffic rule.
   2. Use Add Rule to save the entry.

      

   3. Select Create Rule Group to save the rule group.

      

   4. The newly created rule group appears in the Rule Groups dashboard.

      

3. The Import Rules function uploads rule configurations from a text file.
   1. Choose an existing rule group from the Rule Groups dashboard or select + Create Rule Group followed by Import Rules to open the configuration dialog.

      

      The Import Rule window appears.

      

   2. Upload a .txt file using the Browse function or by dragging and dropping the file into the upload area.

      1 match ip
      2 match tcp
      3 match tcp src-port 80
      4 match tcp dst-port 25                                                

   3. Select Preview to verify the parsed rules.

      

   4. Optional Step: Select Edit next to an entry in the Preview Imported Rule table to modify specific rule parameters.

      

   5. Select Confirm to finalize the preview.
   6. After returning to the Preview Imported Rule dashboard, use Import [x] Rules to complete the process.
   7. Select Create Rule Group to save the rule group.

      

4. Editing a Rule Group.
   1. Select the target row in the table.
   2. Use the Edit button.

      

   3. The system opens the editing panel (identical to the creation interface).

      

   4. Select Save to update the rule group.
5. Deleting a Rule Group
   1. Select one or more rows in the table.

      

   1. Use the Delete button.
   1. The system displays a confirmation dialog.

      

   1. Select Yes to permanently delete the selected rule groups.

1. When setting the auto VLAN mode to push-per-filter, define the range of automatically assigned VLAN IDs by entering the following command from config mode:

   auto-vlan-range vlan-min start vlan-max end

   Replace start and end with the first and last VLAN ID in the range. For example, the following command assigns a range of 100 VLAN IDs from 3994 to 4094:

   controller-1(config)# auto-vlan-range vlan-min 3994 vlan-max 4094

2. Select the VLAN mode using the following command from config mode:

   auto-vlan-mode command { push-per-filter | push-per-policy }

   Find details of the impact of these options in the Managing VLAN Tags in the Monitoring Fabric section.

   For example, the following command adds a unique outer VLAN tag to each packet received on each filter interface:

   controller-1(config)# auto-vlan-mode push-per-filter
   Switching to auto vlan mode would cause policies to be re-installed. Enter "yes" (or "y")
   to continue: y

3. To display the configured VLAN mode, enter the show fabric command, as in the following example:

   controller-1# show fabric
   ~~~~~~~~~~~~~~~~~~~~~ Aggregate Network State ~~~~~~~~~~~~~~~~~~~~~
   Number of switches                          : 5
   Inport masking                              : True
   Start time                                  : 2018-11-02 23:42:29.183000 UTC
   Number of unmanaged services                : 0
   Filter efficiency                           : 1:1
   Number of switches with service interfaces  : 0
   Total delivery traffic (bps)                : 411Kbps
   Number of managed service instances         : 0
   Number of service interfaces                : 0
   Match mode                                  : full-match
   Number of delivery interfaces               : 13
   Max pre-service BW (bps)                    : -
   Auto VLAN mode                              : push-per-filter
   Number of switches with delivery interfaces : 4
   Number of managed devices                   : 1
   Uptime                                      : 2 days, 19 hours
   Total ingress traffic (bps)                 : 550Kbps
   Max overlap policies (0=disable)            : 10
   Auto Delivery Interface Strip VLAN          : False
   Number of core interfaces                   : 219
   Max filter BW (bps)                         : 184Gbps
   Number of switches with filter interfaces   : 5
   State                                       : Enabled
   Max delivery BW (bps)                       : 53Gbps
   Total pre-service traffic (bps)             : -
   Track hosts                                 : True
   Number of filter interfaces                 : 23
   Number of active policies                   : 3
   Number of policies                          : 25
   ------------------------output truncated------------------------

4. To display the VLAN IDs assigned to each policy, enter the show policy command, as in the following example:

   controller-1> show policy
   # Policy Name Action Runtime Status Type Priority Overlap Priority
   ˓→Push VLAN Filter BW Delivery BW Post Match Filter Traffic Delivery Traffic Services
   -|--------------------------|-------|--------------|----------|--------|----------------|--
   ˓→-------|---------|-----------|-------------------------|----------------|----------------
   ˓→-----|
   1 GENERATE-NETFLOW-RECORDS forward installed Configured 100 0 4
   ˓→ 100Gbps 10Gbps - - DMF-OOB-NETFLOWSERVICE
   2 P1 forward inactive Configured 100 0 1
   ˓→ - 1Gbps - -
   3 P2 forward inactive Configured 100 0 3
   ˓→ - 10Gbps - -
   4 TAP-WINDOWS10-NETWORK forward inactive Configured 100 0 2
   ˓→ 21Gbps 1Gbps - -
   5 TIMESTAMP-INCOMING-PACKETS forward inactive Configured 100 0 5
   ˓→ - 100Gbps - - DMF-OOB-TIMESTAMPINGSERVICE
   controller -1>)#

1. Select the CRC Check card.

   

2. Toggle the CRC Check to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

4. CRC Check is running.

   

5. To disable the feature, toggle the CRC Check to Off. Select Disable and confirm.

   

   The feature card updates with the status.

   

1. Select the Custom Priority card.

   

2. Toggle the Custom Priority to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

4. Custom Priority is running.

   

5. To disable the feature, toggle the Custom Priority to Off. Select Disable and confirm.

   

The feature card updates with the status.

1. Select the Device Deployment Mode card.

   

2. Enter the edit mode using the pencil icon.

   

3. Change the switching mode as required using the drop-down menu. The default mode is Auto Discovery.

   

   

4. Select Submit and confirm the operation when prompted.
5. The Device Deployment Mode status updates.

   

1. Select the Inport Mask card.

   

2. Toggle the Inport Mask to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

4. Inport Mask is running.

   

5. To disable the feature, toggle the Inport Mask to Off. Select Disable and confirm.

   

The feature card updates with the status.

1. Select the Match Mode card.

   

2. Enter the edit mode using the pencil icon.

   

3. Change the switching mode as required using the drop-down menu. The default mode is L3-L4 Match.

   

4. Select Submit and confirm the operation when prompted.

1. Select the Retain User Policy VLAN card.

   

2. Toggle the Retain User Policy VLAN to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

4. Retain User Policy VLAN is running.

   

5. To disable the feature, toggle the Retain User Policy VLAN to Off. Select Disable and confirm.

   

   The feature card updates with the status.

   

1. Select the Tunneling card.

   

2. Toggle Tunneling to On.
3. Confirm the activation by selecting Enable. Or, Cancel to return to the DMF Features page.

   

   Note: CRC Check must be running before attempting to enable Tunneling. An error message displays if CRC Check is not enabled. Proceeding to select Enable results in a validation error message. Refer to the CRC Check section for more information on configuring the CRC Check feature.

   

4. Tunneling VLAN is running.

   

5. To disable the feature, toggle Tunneling to Off. Select Disable and confirm.

   

   The feature card updates with the status.

   

Global Configuration

1. To view or edit the global configuration, navigate to the DANZ Monitoring Fabric (DMF) Features page by selecting the gear icon in the navigation bar.

   

   The DMF Feature allows for managing fabric-wide settings for DMF.
2. Scroll to the VLAN Preservation card.

   

   

3. Select Edit (pencil icon) to configure or modify the global VLAN Preservation feature settings.

   

   The edit screen has two input sections:

   • Toggle on or off the Preserve User Configured VLANs.
   • Enter the parameters for VLAN Preserve using the following functions:
     • Use + Add VLAN to add VLAN IDs.
     • Select the Single VLAN type drop-down to add a single VLAN ID.
     • Select the Range VLAN type drop-down to add a continuous VLAN ID range.
     • Use the Trash icon (delete) to delete a single VLAN ID or a VLAN ID range.
4. Select Submit to save the configuration.

Local Configuration

5. The VLAN Preservation configuration can be applied per-delivery interface while configuring or editing a delivery or filter-and-delivery interface in DMF Interfaces and Monitoring Interfaces > Delivery Interfaces .

   

6. The following inputs are available for the local feature configuration:
   • Enable VLAN Preservation. Use this option to preserve all user-configured VLAN IDs in push-per-policy or push-per-filter mode on a selected delivery interface. The packets with the user-configured VLANs will have their fabric-applied VLAN tags preserved even after leaving the respective delivery interface.
   • Preserve User Configured VLANs. Refer to Step 3.
   • Disable VLAN Preservation. Disabling this option will ignore this feature configuration given globally/locally for this delivery interface. VLAN Preservation is enabled by default.
7. Select Save to save the configuration.

VLAN Preservation for MLAG Delivery Interfaces

8. Configure VLAN preservation for MLAG delivery interfaces using the FabricMLAGs page while configuring an MLAG Domain toggling the VLAN Preservation and Preserve User Configured VLANs switches to on (as required).

   

   

1. A partial policy installation may occur if any delivery interface fails to preserve the VLAN tag. This can happen when exceeding the 2000 VLAN ID/Port combination limit. Use the show policy policy-name command to obtain a detailed status, as shown in the following example:

   (config)# show policy vlan-999
   Policy Name                            : vlan-999
   Config Status                          : active - forward
   Runtime Status                         : installed but partial failure
   Detailed Status                        : installed but partial failure - 
                                            Failed to preserve VLAN's on some/all 
                                            delivery interfaces, see warnings for details
   Priority                               : 100
   Overlap Priority                       : 0
   # of switches with filter interfaces   : 1
   # of switches with delivery interfaces : 1
   # of switches with service interfaces  : 0
   # of filter interfaces                 : 1
   # of delivery interfaces               : 1
   # of core interfaces                   : 2
   # of services                          : 0
   # of pre service interfaces            : 0
   # of post service interfaces           : 0
   Push VLAN                              : 999
   Post Match Filter Traffic              : -
   Total Delivery Rate                    : -
   Total Pre Service Rate                 : -
   Total Post Service Rate                : -
   Overlapping Policies                   : none
   Component Policies                     : none
   Installed Time                         : 2023-11-06 21:01:11 UTC
   Installed Duration                     : 1 week

2. Verify the running config and review if the VLAN preservation configuration is enabled for that VLAN ID and on that delivery interface.

   (config-vlan-preservation)# show running-config | grep "preserve"
   ! vlan-preservation
   vlan-preservation
   preserve-vlan 100

3. Verify the show switch switch-name table vlan-preserve output. It displays the ports and VLAN ID combinations that are enabled.

   (config-policy)# show switch core1 table vlan-preserve
   # Vlan-preserve Device name Entry key              
   -|-------------|-----------|----------------------|
   1 0             core1       VlanVid(0x64), Port(6)

4. The same configuration can be verified from a switch (e.g., core1) by using the command below:

   root@core1:~# ofad-ctl gt vlan_preserve
   VLAN PRESERVE TABLE:
   --------------------
   VLAN:  100  Port:    6  PortClass:    6

5. Verify if a switch has any associated preserve VLAN warnings among the fabric warnings:

   (config-vlan-preservation)# show fabric warnings | grep "preserve
   1 delivery1 (00:00:52:54:00:85:ca:51) Switch 00:00:52:54:00:85:ca:51 
   cannot preserve VLANs for some interfaces due to resource exhaustion.

6. The show fabric warnings feature-unsupported-on-device command provides information on whether VLAN preservation is configured on any unsupported devices:

   (config-switch)# show fabric warnings feature-unsupported-on-device 
   # Name Warning                                                      
   -|----|------------------------------------------------------------|
   1 del1 VLAN preservation feature is not supported on EOS switch eos

1. From config mode, specify the switch to be configured with dual management, as in the following example:

   Controller-1(config)# switch DMF-SWITCH-1
   Controller-1(config-switch)#

   The CLI changes to the config-switch submode, to configure the specified switch.

2. From config-switch mode, enter the interface command to specify the interface to be configured as the standby management interface:

   Controller-1(config-switch)# interface ethernet40
   Controller-1(config-switch-if)#

   The CLI changes to the config-switch-if submode, to configure the specified interface.

3. From config-switch-if mode, enter the management command to specify the role for the interface:

   Controller-1(config-switch-if)# management
   Controller-1(config-switch-if)#

1. Select Fabric > Switches from the main menu.

   

2. Select the switch name to be configured with dual management.

   

3. Select the Interfaces tab.

   

4. Identify the interface to be configured as the standby management interface.

   

5. Select Menu to the left of the identified interface, then select Configure.

   

6. Set Use for Management Traffic to Yes. This action configures the interface to the standby management role.

   

7. Select Save.

1. Navigate to Monitoring > Interfaces .

   

2. Under the Configuration tab select either Delivery or Filter & Delivery.
   Note: DMF supports configuring egress filtering rules for Delivery, Filter & Delivery, and Recorder Node interfaces.

   

3. Optional - If required, create a Delivery or Filter & Delivery interface using Create DMF Interface.

   

4. Under the DMF Interface Name, select the Delivery or Filter & Delivery interface to configure additional interface attributes.

   

5. Under Configuration, select + Add Rule in the Egress Filtering Rules section.

   

6. Setting EtherType to either IPv4 or IPv6 displays additional configuration options.
   • Traffic: Basic traffic configurations.
     • Sequence - Enter a numerical value. The lowest sequence number will have the highest priority.
     • Action (drop-down) - Allow or Drop
     • Ethertype (drop-down) - IPv4, IPv6, or Any
   • Source: Single IP or IP Range.
     • IP Address
     • IP Mask
   • Destination: Single IP or IP Range.
     • IP Address
     • IP Mask
   • VLANs: VLAN (drop-down) - Any, Single, or Range.

   

7. Enter all required inputs, and any optional fields that are applicable. Select Submit to save the Egress Filtering Rule.
8. Repeat the process using + Add Rule to add more rules as needed.

   

9. To edit a rule, click the pencil (edit) icon. To delete a rule, select the trash (delete) icon.

Similarly, to configure Egress filtering rules for Recorder Node Interfaces, navigate to Monitoring > Recorder Nodes . Under the Inventory section, select RN Interfaces and the RN interface name to configure the egress filtering rules.

1. Review the show running-config command output to see if the egress filtering rules are configured correctly under that particular interface.
2. Verify the show switch switch-name table egress-flow-1 command output. It will display the port number of the interface for the configured egress filtering rules, its qualifiers as Entry key, the Entry value action of Drop or NoDrop, and a default drop rule for that port number with priority 0.

   dmf-controller# show sw all table egress-flow-1 
   # Egress-flow-1 Device name        Entry key                                                       Entry value                                   
   -|-------------|-----------------|---------------------------------------------------------------|---------------------------------------------|
   1 0             DCS-7050SX3-48YC8 Priority(1000), Port(13), EthType(2048), Ipv4Src(12.123.123.12) Name(__Rule1__), Data([0, 0, 0, 0]), NoDrop()
   2 1             DCS-7050SX3-48YC8 Priority(0), Port(13)                                           Name(__Rule0__), Data([0, 0, 0, 0]), Drop()

3. Use the following command to verify the same information from a switch (e.g., DCS-7050SX3-48YC8).

   root@DCS-7050SX3-48YC8:~# ofad-ctl gt egr_flow1
   GENTABLE : egr_flow1
   GENTABLE ID : 0x0019
   Table count: matched/lookup : 0/0
   Entry count/limit : 2/1024
   guaranteed max: 512, potential max: 1024
   priority 0 out_port 13  drop true  0p/0b eid 17
   priority 1000 out_port 13 eth_type 0x800/0xffff ipv4_src 12.123.123.12/255.255.255.255  drop false  0p/0b eid 22

4. Use the show fabric warnings egress-filtering-warning command to view any egress filtering warnings.

   dmf-controller(config)# show fabric warnings egress-filtering-warning 
   ~~~~~~~~~~~~~~~~~~~~~~~~~ Egress filtering warnings ~~~~~~~~~~~~~~~~~~~~~~~~~
   # Switch               IF Name     Warning message                                        
   -|-----------------|-----------|-----------------------------------------------------|
   1 DCS-7050SX3-48YC8 ethernet18  Supported only on delivery or recorder node interfaces
   2 DCS-7280SR-48C6   Ethernet8   Egress filtering feature is not supported on EOS switches

5. The show fabric warnings feature-unsupported-on-device command provides information on any egress filtering rules configured on any unsupported devices:

   dmf-controller(config)# show fabric warnings feature-unsupported-on-device 
   # Name    Warning                                                      
   -|-------|------------------------------------------------------------|
   1 test1   Egress filtering is not supported on the switch test1

1. Connect switch ports (on remote and main datacenter) to their respective WAN routers and ensure they can communicate via IP.
2. Enable tunneling on the DMF network by entering the following command from config mode:

   controller-1(config)# tunneling
   Tunneling is an Arista Licensed feature. Please ensure that you have purchased the license
   for tunneling before using this feature. enter "yes" (or "y") to continue: yes
   controller-1(config)#

3. Configure the MAC loopback mode, as shown in the following example:

   controller-1(config)# switch DMF-CORE-SWITCH
   controller-1(config-switch)# interface ethernet7
   controller-1(config-switch-if)# loopback-mode mac

4. Create tunnel endpoints.

!
switch remote-dc1-filter-sw
gre-tunnel-interface tunnel1
remote-ip 192.168.200.50
gre-key-decap 4097 === 4097 is the VPN key used for the tunnel ID
parent-interface ethernet6
local-ip 192.168.100.50 mask 255.255.255.0 gateway-ip 192.168.100.1
direction bidirectional encap-loopback-interface ethernet38
!
switch main-dc-delivery-sw
gre-tunnel-interface tunnel1
remote-ip 192.168.100.50
gre-key-decap 4097 === 4097 is the VPN key used for the tunnel ID
parent-interface ethernet5
local-ip 192.168.200.50 mask 255.255.255.0 gateway-ip 192.168.200.1
direction bidirectional encap-loopback-interface ethernet3

!
switch remote-dc1-filter-sw
gre-tunnel-interface tunnel1
remote-ip 192.168.200.50
gre-key-decap 4097 === 4097 is the VPN key used for the tunnel ID
interface parent-interface ethernet6
local-ip 192.168.100.50 mask 255.255.255.0 gateway-ip 192.168.100.1
direction transmit-only encap-loopback-interface ethernet38
!
switch main-dc-delivery-sw
gre-tunnel-interface tunnel1
remote-ip 192.168.100.50
gre-key-decap 4097 === 4097 is the VPN key used for the tunnel ID
parent-interface ethernet5
local-ip 192.168.200.50 mask 255.255.255.0 gateway-ip 192.168.200.1
direction receive-only

1. Connect switch ports (on remote and main datacenter) to their respective WAN routers and ensure that they can communicate via IP.
2. Enable tunneling on the DMF network by entering the following command from config mode:

   controller-1(config)# tunneling
   Tunneling is an Arista Licensed feature. Please ensure that you have purchased the license
   for tunneling before using this feature. enter "yes" (or "y") to continue: yes
   controller-1(config)#

3. Configure the MAC loopback mode, as shown in the following example:

   controller-1(config)# switch DMF-CORE-SWITCH
   controller-1(config-switch)# interface ethernet7
   controller-1(config-switch-if)# loopback-mode mac

4. Create tunnel endpoints.

!
switch remote-dc1-filter-sw
vxlan-tunnel-interface tunnel1
remote-ip 192.168.200.50
parent-interface ethernet6
local-ip 192.168.100.50 mask 255.255.255.0 gateway-ip 192.168.100.1
direction bidirectional encap-loopback-interface ethernet38
!
switch main-dc-delivery-sw
vxlan-tunnel-interface tunnel1
remote-ip 192.168.100.50
parent-interface ethernet5
local-ip 192.168.200.50 mask 255.255.255.0 gateway-ip 192.168.200.1
direction bidirectional encap-loopback-interface ethernet3

!
switch remote-dc1-filter-sw
vxlan-tunnel-interface tunnel1
remote-ip 192.168.200.50
interface parent-interface ethernet6
local-ip 192.168.100.50 mask 255.255.255.0 gateway-ip 192.168.100.1
direction transmit-only encap-loopback-interface ethernet38
!
switch main-dc-delivery-sw
vxlan-tunnel-interface tunnel1
remote-ip 192.168.100.50
parent-interface ethernet5
local-ip 192.168.200.50 mask 255.255.255.0 gateway-ip 192.168.200.1
direction receive-only

1. Enable the tunneling feature before configuring tunnels on a switch using the tunneling command. Enter yes when prompted to continue.

   dmf-controller-1(config)# tunneling
   Tunneling is an Arista Licensed feature. 
   Please ensure that you have purchased the license for tunneling before using this feature.
   Enter "yes" (or "y") to continue: y
   dmf-controller-1(config)#

2. Configure a tunnel by using the remote-ip as 0.0.0.0.

   dmf-controller-1(config)# switch main-dc-delivery-sw
   dmf-controller-1(config-switch)# gre-tunnel-interface tunnel1
   dmf-controller-1(config-switch)# remote-ip 0.0.0.0 === this is to enable wildcard tunnel
   dmf-controller-1(config-switch)# gre-key-decap 4097
   dmf-controller-1(config-switch)# parent-interface ethernet5
   dmf-controller-1(config-switch)# local-ip 192.168.200.50 mask 255.255.255.0 gateway-ip 192.168.200.1
   dmf-controller-1(config-switch)# direction receive-only

dmf-controller-1# show tunnel
# Switch DPID       Tunnel Name Tunnel Status      Direction     Src IP       Dst IP       Parent Name  Loopback Name
-|-----------------|-----------|------------------|-------------|------------|------------|------------|-------------|
1 DMF-CORE-SWITCH-1 tunnel1     ESTABLISHED_TUNNEL bidirectional 198.82.215.1 216.47.143.1 ethernet5:1  ethernet6
2 DMF-CORE-SWITCH-2 tunnel1     ESTABLISHED_TUNNEL bidirectional 216.47.143.1 198.82.215.1 ethernet11:3 ethernet5
3 DMF-CORE-SWITCH-2 tunnel2     ESTABLISHED_TUNNEL bidirectional 192.168.43.1 192.168.42.1 ethernet11:4 ethernet17
4 DMF-CORE-SWITCH-3 tunnel2     ESTABLISHED_TUNNEL bidirectional 192.168.42.1 192.168.43.1 ethernet6    ethernet33

1. Configure the L2 GRE Key Hashing in the UI for a switch in the Fabric > Switches page using the table row menu action Configure option.

   

2. Enable the L2 GRE Key for the IPv4 packets in the LAG Enhanced Hash step.
   Note: The L2 GRE Key is unsupported for IPv6 and VXLAN Inner L3.

   

3. Select Submit to save the configuration.

1. Configure the VXLAN Hashing in the UI for a switch in the Fabric > Switches page using the table row menu action Configure option.

   

2. In the LAG Enhanced Hash step, configure the following fields depending on your requirements:
   • L2 VXLAN Inner L2 fields
   • VXLAN Inner L3 fields
   Note:

   • L2 GRE Key is not supported for VXLAN hash fields.
   • Cannot simultaneously specify enhanced hash for L2 GRE Inner L2 and Inner L3.
   • Cannot simultaneously specify enhanced hash for VXLAN Inner L2 and Inner L3.

   

3. Select Submit to save the configuration.

1. Use the lag-interface command to enter the config-switch-lag-if submode to define the LAG member interfaces and specify the type of load distribution (hashing) to use for the LAG.
2. Use the member command to add an interface to a LAG. Enter this command for each interface to add to the LAG. To remove an interface, use the no member version of the command.
   For example, the following commands add two interfaces to a LAG named my-lag.

   controller-1(config)# switch DMF-FILTER-SWITCH-1
   controller-1(config-switch)# lag-interface mylag
   controller-1(config-switch-lag-if)# member ethernet13
   controller-1(config-switch-lag-if)# member ethernet14

3. To configure multiple delivery interfaces as a LAG, complete the following steps:
   1. Assign a name to the LAG and enter the config-switch-lag-if submode.

      controller-1(config)# switch DMF-DELIVERY-SWITCH-1
      controller-1(config-switch)# lag-interface lag1
      controller-1(config-switch-lag-if)#

   2. Assign members to the LAG.

      controller-1(config-switch-lag-if)# member ethernet39
      controller-1(config-switch-lag-if)# member ethernet40

4. To configure a core LAG apply the membership configuration to both ends of the connection:

   controller-1(config)# switch SWITCH-1
   controller-1(config-switch)# lag-interface core-link
   controller-1(config-switch-lag-if)# member ethernet1
   controller-1(config-switch-lag-if)# member ethernet3

   controller-1(config)# switch SWITCH-2
   controller-1(config-switch)# lag-interface core-link
   controller-1(config-switch-lag-if)# member ethernet49
   controller-1(config-switch-lag-if)# member ethernet51

    

   Note: Ensure that when you set up a core LAG between DMF fabric switches it is properly configured on both sides of the connection; otherwise, you will get a lag_misconfiguration error state. You need to configure link aggregation symmetrically on both ends of a connection for it to work properly.

    

5. To view the configured LAGs, enter the show lag command, as in the following example:

   controller-1> show lag
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lag Interfaces  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   # Switch   LAG       State Rx Rate Pkt Rate Peak Rate Peak Pkt Rate TX Rate Pkt Rate Peak Rate Peak Pkt Rate 
   -|--------|---------|-----|-------|--------|---------|-------------|-------|--------|---------|-------------|
   1 SWITCH-1 core-link up    720bps  0        2.59Gbps  608181        184bps  0        53.2Mbps  37150
   2 SWITCH-2 core-link up    184bps  0        424bps    0             720bps  0        1.08Kbps  1
   
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Member Interfaces  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   # Switch   LAG       Member     State Fault Rx Rate Pkt Rate Peak Rate Peak Pkt Rate Tx Rate Pkt Rate Peak Rate Peak Pkt Rate 
   -|--------|---------|----------|-----|-----|-------|--------|---------|-------------|-------|--------|---------|-------------|
   1 SWITCH-1 core-link ethernet1  up          624bps  0        800bps    1             88bps   0        152bps    0
   2 SWITCH-1 core-link ethernet3  up          96bps   0        18.5Mbps  1735          88bps   0        136bps    0
   3 SWITCH-2 core-link ethernet49 up          88bps   0        152bps    0             624bps  0        800bps    1
   4 SWITCH-2 core-link ethernet51 up          88bps   0        280bps    0             96bps   0        18.5Mbps  1735

1. Configure an MLAG domain by specifying an alias, and add peer switches that will be participating in the MLAG.

   Controller-1(config)# mlag-domain MLAG-Domain1
   Controller-1(config-mlag-domain)# peer-switch DeliverySwitch-1
   Controller-1(config-mlag-domain)# peer-switch DeliverySwitch-2

2. Configure the core MLAG interface.

   Controller-1(config-mlag-domain)# mlag-interface MLAG-Core-Intf
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-1 interface ethernet50
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-2 interface ethernet50

   The above MLAG interface configuration selects one physical interface from each peer switch added into the MLAG domain. This MLAG interface is fabric-facing, which means that ethernet50 of DeliverySwitch-1 and ethernet50 of DeliverySwitch-2 are connected to the DMF core switch, where traffic hashing is performed.

3. Configure the core LAG interface, a LAG interface on the core switch. The members of the LAG interface are connected to the peer switches in the MLAG domain. This configuration ensures that the traffic will be hashed toward the two connected delivery switches.

   Controller-1(config)# switch CoreSwitch-1
   Controller-1(config-switch)# lag-interface Core-LAG
   Controller-1(config-switch-lag-if)# member ethernet10
   Controller-1(config-switch-lag-if)# member ethernet20

4. Configure the delivery MLAG interface by specifying an interface alias and selecting one member from each delivery switch.

   Controller-1(config-mlag-domain-if)# mlag-interface MLAG-Del-Intf
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-1 interface ethernet1
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-2 interface ethernet1
   Controller-1(config-mlag-domain-if)# role delivery interface-name MLAG-Tool-1

   The above MLAG interface configuration selects one physical interface from each peer switch added into the MLAG domain. The members of this MLAG interface, ethernet1 of DeliverySwitch-1 and ethernet1 of DeliverySwitch-2, are connected to multi-homed tools. Note that unlike the core MLAG interface, the delivery MLAG interface is assigned the delivery role and its interface name is configured, so that it can be used in DMF policies as a delivery interface.

5. Configure a DMF policy by following the procedure shown below:

   Controller-1(config)# policy Policy-1
   Controller-1(config-policy)# action forward
   Controller-1(config-policy)# 1 match any
   Controller-1(config-policy)# filter-interface Filter-1
   Controller-1(config-policy)# delivery-interface MLAG-Tool-1

   The above policy is configured using the MLAG-Tool-1 interface configured in Step 4. Configuring the policy to use an MLAG delivery interface will result in two dynamic policies, one for each peer switch. Refer to the following topology for the policy breakdown.

   

As seen in the topology above:

• The user-configured policy delivers traffic from the filter switch to the core switch LAG interface.
• Dynamic Policy 1 delivers traffic to delivery switch 1.
• Dynamic Policy 2 delivers traffic to delivery switch 2.

The following output displays the three policies as configured on the DMF controller:

Below are the details for each policy:

Policy: Policy-1 Interfaces

• Filter Interface(s) section lists the filter interface configured for the policy, Policy-1.
• Core Interface(s) section lists the interfaces that connect the filter switch and the core switch selected for the policy.
• MLAG Core Interface(s) section displays the core LAG interface that hashes the traffic towards the peer switches.
• MLAG Delivery Interface(s) section lists the delivery MLAG interface members.

Policy: _mlag_Policy-1_DeliverySwitch-1 Interfaces

• Filter Interfaces(s) section lists the dynamically configured interface name on DeliverySwitch1 to which the core switch is connected.
• MLAG Delivery Interface(s) section lists the delivery MLAG interface member on DeliverySwitch1.

Policy: _mlag_Policy-1_DeliverySwitch-2 Interfaces

• Filter Interfaces(s) section lists the dynamically configured interface name on DeliverySwitch2 to which the core switch is connected.
• MLAG Delivery Interface(s) section lists the delivery MLAG interface member on DeliverySwitch2.

1. Configure the LAG interface on Peer Switch 1.

   Controller-1(config)# switch DeliverySwitch-1
   Controller-1(config-switch)# lag-interface LAG-peer-switch-1
   Controller-1(config-switch-lag-if)# member ethernet11
   Controller-1(config-switch-lag-if)# member ethernet12

2. Configure the LAG interface on Peer Switch 2.

   Controller-1(config)# switch DeliverySwitch-2
   Controller-1(config-switch)# lag-interface LAG-peer-switch-2
   Controller-1(config-switch-lag-if)# member ethernet11
   Controller-1(config-switch-lag-if)# member ethernet12

3. Add the configured LAG interfaces as members into the MLAG interface.

   Controller-1(config)# mlag-domain Domain1
   Controller-1(config-mlag-domain)# mlag-interface MLAG-LAG-Del-Intf
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-1 interface LAG-peer-switch-1
   Controller-1(config-mlag-domain-if)# member switch DeliverySwitch-2 interface LAG-peer-switch-2
   Controller-1(config-mlag-domain-if)# role delivery interface-name MLAG-LAG-Tool-1

4. Configure the DMF policy using the delivery interface MLAG-LAG-Tool-1.

   Controller-1(config)# policy Policy-1
   Controller-1(config-policy)# action forward
   Controller-1(config-policy)# 1 match any
   Controller-1(config-policy)# filter-interface Filter-1
   Controller-1(config-policy)# delivery-interface MLAG-LAG-Tool-1

   Note: Traffic will not hash toward tools if the core switch LAG has the same number of member interfaces as the LAG on the peer switches of MLAG delivery.

   Workaround:

   • Ensure that the hash fields on the core switch and MLAG peer switches are different or:
   • Ensure that the number of member interfaces in the LAG interface configured on the core switch differs from the number of members in the LAG interface configured on peer switches.

1. Select Monitoring > Recorder Nodes from the main menu bar of the DANZ Monitoring Fabric (DMF) GUI.

   

2. To add a new RN, select the Add Recorder Node (Recorder Nodes tab active) in the Inventory section.

   

3. Enter the following information in the required fields:
   • Assign a name to the RN.
   • Set the MAC Address of the RN. Obtain the MAC address from the chassis ID of the connected device, using the Fabric > Connected Devices .

     

4. Configure the following options as needed:
   • Recording: Recording is enabled by default. To disable recording on the RN, move the Recording toggle switch to Off. When recording is enabled, the RN records the matching traffic directed from the filter interface defined in a DMF policy.
   • Disk Full Policy: The default packet removal policy is Continuous operating as FIFO (First In First Out), which means the oldest packets are deleted to make room for newer packets. This occurs only when the RN disks are full. The alternative removal policy is Stop, which causes the RN to stop recording when the disks are full and wait until disk space becomes available. Disk space can be made available by leveraging the RN delete operation to remove all or selected time ranges of recorded packets.
   • Backup Disk Policy: Specify the disk backup policy to as desired. Select from one of the three following options:
     • No Backup: This is the default option and is also the recommended option when no extra disk is available.
     • Remote Extend: In this option, recording is performed on the local disks. When full, the recording continues on a remote Isilon cluster mounted over NFS. In this mode, the remote disks are called backup disks. With regard to the Disk Full Policy, if set to:
       • Stop: Recording stops when both local and remote disks become full.
       • Continuous: When the configured threshold is reached, the oldest files from both disks are removed until the disk usage returns below the threshold number.
     • Local Fallback: In this option, recording is performed on a remote Isilon cluster mounted over NFS. If the connection between the Recorder Node and the remote cluster fails, the recording is performed on the local disks until the failure is resolved. In this mode, the local disks are called backup disks. With regard to the Disk Full Policy, if set to:
       • Stop: Recording stops when the remote disks become full.
       • Continuous: When the configured threshold is reached, the oldest files from both disks are removed until the disk usage returns below the threshold number.
     Note: A connection failure should not occur due to a misconfiguration of the NFS server on the DMF Controller. In such cases, the recording stops until the Controller’s configuration is fixed.
   • Max Packet Age: Change the Max Packet Age to set the maximum number of minutes that recorded packets are kept on the RN. Packets recorded are discarded after the specified number of minutes. This defines the maximum age in minutes of any packet in the RN. It can be used in combination with the Disk Full Policy to control when packets are deleted based on age rather than disk utilization alone. When unset, Max Packet Age is not enforced.
   • Incident Look Ahead Buffer: Assign the number of minutes the RN pre-buffer allows for windowed retention of packets received by the RN for a specified length of time. By default, the Incident Look Ahead Buffer is set to zero minutes (disabled). With a nonzero Incident Look Ahead Buffer setting and triggering a recorder event, any packets in the pre-buffer are saved to disk, and any packets received by the recorder after the trigger are saved directly to disk. When terminating an ongoing recorder event, a new pre-buffer is established in preparation for the next event.
   • Max Disk Utilization: Specify the maximum utilization allowed on the index and packet disks. The Disk Full Policy is enforced at this limit. If left unset, then the disks space are used to capacity.
   • Parse MetaWatch Trailer: Determine the parsing of the MetaWatch trailer.
     • Off: When set to Off, the RN will not parse the MetaWatch trailer, even if it is present in incoming packets.
     • Auto: When set to Auto, the RN will look for a valid timestamp in the last 12 bytes of the packet. If it matches the system timestamp closely enough, the trailer is parsed by the RN.
     • Always: When set to Always, RN will assume the last 12 bytes of packet is a MetaWatch trailer and parse it, even if it did not find a valid timestamp.
   • Indexing: All the indexing options are enabled by default. To disable any of the indexing behaviors, select Indexing and deselect from the list, as required. These include:
     • MAC Source
     • MAC Destination
     • VLAN 1
     • VLAN 2
     • VLAN 3
     • IPv4 Source
     • IPv4 Destination
     • IPv6 Source
     • IPv6 Destination
     • IP Protocol
     • Port Source
     • Port Destination
     • MPLS
     • Community ID
     • MetaWatch Device ID
     • MetaWatch Port ID

     For more details, see the Indexing Configuration section.

5. Configure network and storage settings selecting Network & Storage Config.
   In order to store packets on external storage using an NFS mount, connect the Recorder Node's (RN) auxiliary interface to the same network and subnet where the NFS storage resides, as displayed in the figure below.

   

   Note: Create the volume for the index and packet on the NFS storage first. Refer to the vendor-specific NFS storage documentation about creating the volume (or path).

   

   1. Auxiliary NIC Configuration: Move the toggle switch to On.
      Enter the IP Address and Mask. These are required fields.

      

   2. Index Disk Configuration: Move the toggle switch to On.
      Enter the NFS Server as an IP address or hostname. For external NFS storage, such as Isilon, connect the auxiliary interface of the RN to a network and subnet that is reachable to Isilon NFS storage. When recording to an Isilon cluster over NFS with SmartConnect, the name of the storage pool can be specified. SmartConnect requires this name be registered as an A record pointing to the SmartConnect VIP in the DNS server used by the recorder node. The recorder will establish many mount points to the provided volume name in this storage pool. Each mount point will resolve to a different node in the storage pool, allowing the recorder to distribute recorded packets and metadata across multiple nodes in parallel.
      Enter the Volume: Specify the storage location or path on the NFS server for the Index Disk.
      Enter the Transport Port of NFS Service details. DMF uses the default value (2049) if no value is specified. Specify a value if the NFS storage has been configured to use something other than the default value.

      

   3. Packet Disk Configuration: Move the toggle switch to On.
      Enter the NFS Server as an IP address or hostname. For external NFS storage, such as Isilon, connect the auxiliary interface of the RN to a network and subnet that is reachable to Isilon NFS storage. When recording to an Isilon cluster over NFS with SmartConnect, the name of the storage pool can be specified. SmartConnect requires this name be registered as an A record pointing to the SmartConnect VIP in the DNS server used by the recorder node. The recorder will establish many mount points to the provided volume name in this storage pool. Each mount point will resolve to a different node in the storage pool, allowing the recorder to distribute recorded packets and metadata across multiple nodes in parallel.
      Enter the Volume: Specify the storage location or path on the NFS server for the Packet Disk.
      Enter the Transport Port of NFS Service details. DMF uses the default value (2049) if no value is specified. Specify a value if the NFS storage has been configured to use something other than the default value.

      

6. Select Add Recorder Node to save and close the configuration page.

   

dmf-controller-1># restart recorder-node rn-name application

1. To add a new RN interface, select the RN Interfaces tab in the Inventory section.

   

2. Select Create RN Interface.

   

3. Enter or select the following parameters:
   • Recorder Node Interface Name: Assign a name to the interface.
   • Switch Name: Select a switch from the drop-down list containing the interface connecting the RN to the monitoring fabric.
   • Interface Name: Select an interface from the drop-down list connecting the RN to the monitoring fabric.
   • Description: (optional) Enter a description of the RN interface.
4. Select Create RN Interface to add the configuration to the DMF Controller.

1. Select the RN Interfaces tab in the Inventory section.

   

2. Select an interface from the Inventory list and use the Edit icon.

   

3. Edit the following parameters:
   • Switch Name: Select a switch from the drop-down list containing the interface connecting the RN to the monitoring fabric.
   • Interface Name: Select an interface from the drop-down list connecting the RN to the monitoring fabric.
   • Description: (optional) Edit the description of the RN interface.
4. Select Edit RN Interface to modify and update the interface configuration.
5. To delete an interface, use the Delete icon and Confirm.