Enhancing Cisco Networks With Gigamon - NDM

Enhancing Cisco Networks with Gigamon // White Paper The Smart Route To Visibility Many Fortune 1000 companies and beyond implement a Cisco switching architecture. When implementing a large scale Cisco network, the infrastructure to effectively monitor these networks is often overlooked. To monitor the networks customers will use Cisco technologies such as SPAN, RSPAN, ERSPAN, VACL. Many times these technologies are not scalable to support the diverse needs of network and security groups as they strive for maximum uptime within the network infrastructure. This white paper will discuss the various monitoring functions Cisco provides and how you can enhance these technologies using the Gigamon Traffic Visibility Fabric and TAP solutions. and Non-VLAN traffic to be sent to the same port. In summary, SPAN sessions are good for spot analysis but are limited in terms of scaling to support company monitoring initiatives. SPAN ports are typically best for small to medium environments where monitoring needs are not great. Source Data Port Cisco SPAN SPAN stands for Switch Port Analyzer. The SPAN functionality is SPAN Port offered in all Cisco switching solutions. A SPAN port copies data from one or more source ports to a destination port. Figure 1 shows an example of how the SPAN function operates. With most Cisco switching products, users are limited to two SPAN sessions per switch. For most large enterprises this is not suitable enough for monitoring purposes. In most large organizations between the network and security groups there are commonly four or more monitoring or analysis tools that all need to contend for the same data. Examples of some of the Figure 1 Cisco SPAN example Inside a Cisco Switch data is copied from a network port (in this example the port the router is connected to) to a SPAN port which has a monitoring tool connected tools that are utilized are Application Performance Monitors, Intrusion Detection Tools, Data Recorders, Web Monitoring Tools, and many more. There are also limitations that prevent users from sending data from one source port to both of the available SPAN sessions as well as limitations that allow VLAN 1

Enhancing Cisco Networks with Gigamon // White Paper The Smart Route To Visibility Figure 3 Cisco ERSPAN example Source Data SPAN Data In GRE Tunnel SPAN Data In GRE Tunnel Source Data SPAN Data In GRE Tunnel Monitoring Tool Routed Network Cisco RSPAN Cisco ERSPAN Cisco RSPAN stands for Remote Switch Port Analyzer. RSPAN ERSPAN stands for Encapsulated Remote SPAN. With ERSPAN works very much like SPAN with the exception that data can data from remote switches can be forwarded to a source be sent between remote monitoring ports in the switching monitoring tool over a routed network or Internet using a architecture using VTP and reflector ports. GRE Tunnel that is configured on the Cisco Switches. ERSPAN is a feature that is only supported on Cisco Switches Users are only allowed to send data to two RSPAN destinations. that support the Supervisor Engine 720 manufactured with Just like SPAN, data from the same source port or VLAN cannot PFC3A. This means this feature is limited to a few Cisco switch be shared across the two sessions. RSPAN has additional families like the Catalyst 6500 family. This functionality has configuration complexity as users have to configure the correct not translated to the newer Cisco Nexus product line as an VTP domains on each switch that RSPAN data traverses. There option. Packets of an ERSPAN session are tagged with a 50- is a potential for duplicate packets in RSPAN configurations. byte header and replace the CRC. Items you need to be aware RSPAN ports will not pass Layer 2 data as well. of are fragmented frames and jumbo frames. ERSPAN does not support fragmented frames and all switches have to be configured to support jumbo frames or else frames that increase Originating switch with reflector port RSPAN VLAN past the 1500 byte limit with the 50 byte tagged data will be RSPAN VLAN SPAN Data dropped. Just like all other SPAN technologies you can only create two ERSPAN destinations per switch. ERSPAN requires additional configuration complexity to ensure that the tunneling Monitoring Tool and frame sizes are correct for proper routing of data. Figure 2 CISCO RSPAN example Cisco VACL Data on the originating switch is sent over a RSPAN VLAN VACL stands for VLAN Access List. VACLs overcome most created using VTP and Reflector Ports. SPAN limitations in addition to providing the ability to filter for certain types of traffic such as a TCP port or IP Address. VACLs are ACLs that only apply to data within a VLAN that are separate from ACLs that would be used in router configurations. The maximum number of VACLs a switch can support is determined 2

Enhancing Cisco Networks with Gigamon // White Paper The Smart Route To Visibility by the amount of VLANs in a switch. For example if a switch Load-Balancing data from multiple 10G and 1G network only has 5 configured VLANs then you can create 5 VACL links to multiple 10G and 1G network tool interfaces capture ports. Advanced features such as time-stamping, port Users will mainly use VACLs to free up SPAN resources as a tagging, and packetslicing bandaid to a complete monitoring infrastructure. Configuring ACL Rule VACLs is usually reserved for more senior networking staff as ACL Rule VACLs require the most configuration attention of all the Cisco ACL Rule Source Data port that belongs to VLAN 200 Network Visibility Technologies. Many users can mistakenly ACL Rule VLAN 200, IP 1.1.1.1 block data from the VACL capture port if care is not taken when configuring the VACL. Like SPAN’s, VACLs source data cannot VACL Port be sent to multiple VACLs limiting the benefit of having extra VACL ports as many times monitoring tools will have to see many VLANs at once leaving the user with one or two VACL capture ports that can be used. Gigamon GigaVUE Traffic Visibility Nodes Gigamon GigaVUE Traffic Visibility Nodes are purpose built appliances create an out-of-band network that provides enhanced visibility to all monitoring, data capture, and security Monitoring Tool Figure 4 Cisco VACL example Data from IP address 1.1.1.1 in VLAN 200 is forwarded to a VLAN capture port tools. With Traffic Visibility Nodes users can connect inputs and aggregate, replicate, and filter data all at line-rate speeds to any number of tools. Users can connect SPAN’s, RSPAN’s, VACL’s, ERSPAN, and TAP input ports to control the traffic flow from all network inputs to all monitoring inputs. You can think of the Traffic Visibility Node as the central hub of your monitoring infrastructure that is becoming a key component in new 10G and 1G data centers. TX RX TX RX TX TX There are many benefits that users can gain by implementing a Traffic Visibility Node such as GigaVUE: Network Switch Network Switch Monitoring Tool Eliminating SPAN, RSPAN, ERSPAN, VACL contention issues Providing secure access to monitoring data Figure 5 Logical TAP Traffic Flow Diagram Accessing 10G network links with 1G monitoring tools Enabling visibility into data across asymmetric links Filtering of any field Layer 1-4 within a packet as well as “user defined” filters that delve deeper into packet structures G-TAP A-TX G-TAP A-TX Main Pwr G-TAP A-TX Batt Pwr Batt Pwr A Mgmnt (PoE) PoE Console Pwr Gigamon OUT B A Network X IN OUT Y IN X OUT YOUT B Main Pwr Monitor/Tool OUT X IN OUT Y IN X OUT Batt Pwr YOUT OUT X IN OUT Y IN A Mgmnt (PoE) PoE Console Pwr X OUT YOUT OUT B Network X IN OUT Y IN X OUT YOUT A B Main Pwr Monitor/Tool OUT X IN OUT Y IN X OUT YOUT OUT X IN OUT Y IN A Mgmnt (PoE) PoE Console Pwr X OUT YOUT B A Network OUT X IN OUT Y IN B Monitor/Tool X OUT YOUT OUT X IN OUT Y IN X OUT YOUT G-Tap Consolidating monitoring resources to one centrally managed location Figure 6 Gigamon G-TAP and G-TAP A-Series TAP’s 3

Enhancing Cisco Networks with Gigamon // White Paper The Smart Route To Visibility Figure 7 Sample configuration in a Flat Network SPAN Traffic SPAN Traffic SPAN Traffic Gigamon 10GigaPORT-8X SPAN Traffic 1G/10G PORTS (SFP ) SLOT 2 IntelligentDAN TM PORTS 9 Pwr GigaVUE-2404MB 1G/10G PORTS (SFP ) 10/100/1000 PORTS (SFP) M/S G1 Rdy G2 G3 G4 G1 G2 G3 G4 1 2 1 3 2 4 3 5 4 6 5 7 6 SLOT 1 8 7 16 8 GigaVUE - 212 Console 1G/10G PORTS (SFP ) Mgmt PORTS G1-G4 PORTS 1-8 Pwr Mgmt 10GigaPORT-8X SLOT 3 PORTS 17 1 3 2 4 5 7 1 3 6 8 2 4 5 7 X1 6 8 X2 1G/10G PORTS Pwr Rdy M/S Console 10/100/1000 PORTS 1G PORTS 24 Pwr UP WHEN INSTALLED IN REAR SLOT GigaVUE-2404 1G Monitoring Tools Figure 8 Example of Gigamon Flow Mapping technology 10G SPAN Data Filtered Data Stream Map-Rule 1 10G RSPAN Data 10G VACL Data Map-Rule 2 Map-Rule 3 Filtered Data Stream Filtered Data Stream Map-Rule 4 10G ERSPAN Data Map-Rule 5 Map-Rule 6 G-TAP A-Tx Batt Pwr Main Pwr Mgmnt (PoE) PoE Console Pwr A B Network A B 1G Full-Duplex Tap Data Filtered Data Stream Filtered Data Stream The Map-Rules represent different flows that are strategically directed to the monitoring ports Filtered Data Stream Monitor/Tool Gigamon G-TAP A-Tx Ingress and Egress Port Filters can applied in addition to Map-Rules Gigamon GigaVUE Data Access Switch 4