Skip to main content

Network maintenance

Topics

• Manage mirroring vSwitches

• Connectivity test

• Manage traffic block logs

Manage mirroring vSwitches​

A mirroring switch is a network feature that copies and sends traffic from a port to another port for

analysis and monitoring, widely used in network management, troubleshooting, and security monitoring. In a virtualization environment, a mirroring vSwitch is deployed for packet replication and monitoring. It allows you to copy the network traffic of one or more VMs to the specified port for further monitoring and analysis.

Restrictions and guidelines

• The vSwitches for Mirroring page only displays mirroring switches created from this page. It does not display mirroring switches created from the Hosts or Clusters page.

• Mirroring switches are mutually exclusive with virtual firewalls. If an NIC has been bound to a virtual firewall, it cannot be used by any mirroring switch.

Add a mirroring vSwitch

About this task

Perform this task to configure traffic mirroring for a vSwitch, which copies and outputs network traffic from a designated port or VM to one or more target ports or devices.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > vSwitches for Mirroring.

  3. Click Add.

  4. Configure basic settings.

    ○ Name: Name of the mirroring vSwitch.

    ○ Description: Description of the mirroring vSwitch.

    ○ Cluster: Cluster to which the mirroring vSwitch belongs. You can select one or multiple clusters. If the management platform has managed cluster hosts with a lower version (for example, the management platform version is E0783 and the cluster host version is E0730), lower-version clusters will not be displayed during the creation of a mirroring vSwitch.

    ○ Network Type: Network type of the vSwitch. Only Mirror Networks is supported.

    ○ Forwarding Mode: Forwarding mode of the vSwitch. Only VEB is supported, which is not editable.

  5. Configure host network settings. a. In the Configure Host Network area, click Add, select hosts, and then click OK. b. Click Configure NIC in the Actions column for each host, configure the related parameters, and then click OK. If you click Cancel, the configured NIC settings will not be saved.

    ▪ Physical NIC: Assign a physical NIC interface for use by the vSwitch. You can select only one physical interface.

    ▪ IPv4 Address: IPv4 address of the vSwitch, which is not configurable.

    ▪ Subnet Mask: Subnet mask for the IPv4 address, which is not configurable.

    ▪ IPv4 Gateway: IPv4 gateway address for the host, which is not configurable. A host can have only one IPv4 gateway address.

    ▪ IPv6 Address: IPv6 address of the vSwitch, which is not configurable.

    ▪ Prefix Length: Prefix length for the IPv6 address, which is not configurable.

    ▪ IPv6 Gateway: IPv6 gateway address for the host, which is not configurable. A host can have only one IPv6 gateway address.

    ▪ Apply to All hosts: Select whether to apply the NIC configuration of the current host to the other selected hosts.

    1. Click OK. To cancel adding the vSwitch, click Cancel.

    2. (Optional.) To detach a host from the vSwitch, click Delete in the Actions column for that host, and then click OK.

Attach hosts to a mirroring vSwitch

About this task

Perform this task to attach hosts to a mirroring vSwitch, which enables precise capture and analysis of target traffic.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > vSwitches for Mirroring.

  3. Select the target mirroring vSwitch.

  4. Click the Hosts tab, and then click Add.

    ○ Cluster: Cluster to which the mirroring vSwitch belongs. You can select one or multiple clusters. If the management platform has managed cluster hosts with a lower version (for example, the management platform version is E0783 and the cluster host version is E0730), lower-version clusters will not be displayed during the creation of a mirroring vSwitch.

  5. In the dialog box that opens, click the icon, select one or multiple clusters, and then click OK.

  6. Click Add, select the desired hosts, and then click OK.

  7. Click Configure NIC in the Actions column for each host, configure the related parameters, and then click OK. If you click Cancel, the configured NIC settings will not be saved.

    ○ Physical NIC: Assign a physical NIC interface for use by the vSwitch. You can select only one physical interface.

    ○ IPv4 Address: IPv4 address of the vSwitch, which is not configurable.

    ○ Subnet Mask: Subnet mask for the IPv4 address, which is not configurable.

    ○ IPv4 Gateway: IPv4 gateway address for the host, which is not configurable. A host can have only one IPv4 gateway address.

    ○ IPv6 Address: IPv6 address of the vSwitch, which is not configurable.

    ○ Prefix Length: Prefix length for the IPv6 address, which is not configurable.

    ○ IPv6 Gateway: IPv6 gateway address for the host, which is not configurable. A host can have only one IPv6 gateway address.

    ○ Apply to All hosts: Select whether to apply the NIC configuration of the current host to the other selected hosts.

  8. Select the desired hosts, and then click OK.

  9. (Optional.) Select the desired hosts, and then click Cancel to cancel the modification.

Add bridge port mirroring settings

About this task

Perform this task to copy and output network traffic from designated ports to one or more target ports, which facilitates network monitoring, fault diagnosis, and security auditing.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > vSwitches for Mirroring.

  3. Click the Mirroring Settings tab, click Add in the Actions column for the target mirroring vSwitch, and then configure the following parameters:

    ○ Probe VLAN ID: VLAN ID reserved for the mirroring vSwitch.

    ○ Direction: Direction of the packets that the mirroring vSwitch can copy from the source port:

    ▪ Inbound Direction—Packets sent from the specified VM port to the vSwitch.

    ▪ Outbound Direction—Packets sent from the vSwitch to the specified VM port.

    ▪ Bidirectional—Packets sent and received by the vSwitch.

  4. Click the Select Mirroring Source button.

  5. Click the VMs or vNICs tab, select the desired mirroring sources, and then click OK to return to the Add Bridge Port Mirroring Settings dialog box. You can filter mirroring sources by VM alias, host name, or MAC address). The Select Mirroring Source dialog box does not display VMs whose port profiles contain a VLAN ID of 1.

  6. (Optional.) To detach a mirroring source, click Delete in the Actions column for that mirroring source.

  7. Click OK.

  8. (Optional.) Click Close to cancel adding bridge port mirroring settings.

  9. To view the details of a bridge port mirroring configuration entry, click Details in the Actions column for that entry.

Back up bridge port mirroring settings

About this task

Perform this task to export bridge port mirroring settings to the local PC for data backup. With the backup configuration file, you can restore the original bridge port settings upon device failure or misconfiguration.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > vSwitches for Mirroring.

  3. Click Back Up in the Actions column for the target mirroring vSwitch.

  4. In the dialog box that opens, configure a description, and then click OK.

    ○ Description: Description of the bridge port mirroring settings to be backed up.

Restore bridge port mirroring settings

About this task

Perform this task to import bridge port mirroring settings to the management platform for configuration restoration.

Restrictions and guidelines

When you import bridge port mirroring settings, you can select whether to retain the original bridge port mirroring settings:

• If you enable this service, the system will retain the original bridge port mirroring settings of the related VM NICs.

• If you do not enable this service, the system will update the bridge port mirroring settings of the related VM NICs, according to the imported bridge port mirroring settings.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > vSwitches for Mirroring.

  3. Click Restore in the Actions column for the target mirroring vSwitch, and then import the file that contains the desired bridge port mirroring settings.

  4. In the dialog box that opens, configure parameters as needed, and then click OK.

Parameters

• Description: Description of the bridge port mirroring settings to be imported.

• File Name: Name of the file that contains the bridge port mirroring settings to be imported.

• Retain Existing Settings: Whether to retain the original bridge port mirroring settings on the vSwitch. If you do not enable this service, the system will update the bridge port mirroring settings of the related VM NICs, according to the imported bridge port mirroring settings.

Filter NICs configured with bridge port mirroring settings

About this task

Perform this task to filter NICs configured with bridge port mirroring settings. Supported filter conditions include VM alias, probe VLAN ID, and direction.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > vSwitches for Mirroring.

  3. Select the target mirroring vSwitch.

  4. Click the Mirroring Settings tab, select VM Settings or NIC Settings, and then configure the filter conditions as needed.

  5. Click Filter. After the vNIC filtering is completed, you can click the Reset button to reset the filter conditions to default.

Export information about NICs configured with bridge port mirroring settings

Perform this task to export detailed information about NICs configured with bridge port mirroring settings. The vNIC details will be exported as an Excel or PDF file.

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > vSwitches for Mirroring.

  3. Select the target mirroring vSwitch.

  4. Click the Mirroring Settings tab, and then click the Export button.

  5. Select the desired file format, and then click OK.

Edit bridge port mirroring settings

About this task

Perform this task to edit the bridge port mirroring settings for a VM attached to a vSwitch.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > vSwitches for Mirroring.

  3. Select the target mirroring vSwitch.

  4. Click the Mirroring Settings tab, click Edit in the Actions column for the target VM, and then configure the following parameters as needed:

    ○ Alias: Name of the VM on the management platform.

    ○ Probe VLAN ID: VLAN ID reserved for the mirroring vSwitch.

    ○ Direction: Direction of the packets that the mirroring vSwitch can copy from the source port:

    ▪ Inbound Direction—Packets sent from the specified VM port to the vSwitch.

    ▪ Outbound Direction—Packets sent from the vSwitch to the specified VM port.

    ▪ Bidirectional—Packets sent and received by the vSwitch.

  5. Click OK to complete the modification.

  6. (Optional.) Click Cancel to cancel the modification.

Remove VMs configured with bridge port mirroring

About this task

Perform this task to remove one or multiple VMs configured with bridge port mirroring. The related mirroring vSwitch no longer monitors the traffic of those VMs.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > vSwitches for Mirroring.

  3. Select the target mirroring vSwitch.

  4. Click the Mirroring Settings tab.

    ○ To remove a single VM, and then click Delete in the Actions column for the target VM.

    ○ To remove multiple VMs in bulk, select the target VMs, and then click the Bulk Delete button above the vNIC list.

  5. Click OK.

Remove a host configured with bridge port mirroring

About this task

Perform this task to remove a host configured with bridge port mirroring.

Connectivity test​

This feature detects whether a host or VM in the system can access another host, VM, or IP address.

Supported protocols include ICMP, TCP, UDP, ICMPv6, TCPv6, and UDPv6. Before you conduct a connectivity test between VMs, verify that the related VMs are not associated with any vFirewall policies.

Procedure

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > Connectivity Test.

  3. Configure the parameters as needed, including protocol, source end, and target end. For more information about the parameters, see "Parameters."

  4. Click Start. You can view the test results on the right side of the page, including link summary, connectivity status, and nodes and ports that packets traverse during packet forwarding.

Parameters

• Protocol: Protocol used to conduct the connectivity test. Options include ICMP, TCP, UDP, ICMPv6, TCPv6, and UDPv6. The system checks for packet loss only if the selected protocol is ICMP or ICMPv6.

• Port: This parameter is required when the selected protocol is TCP, UDP, TCPv6, or UDPv6. The default port number is 22.

• Source Type: Type of the source. If the source or target type is VM, the system does not display SR-IOV straight-through NICs and you cannot select those NICs. Options are Virtual Machine and Physical Host.

○ Source VM/Host: Source VM or host in the connectivity test. Supported options vary by the source type. In separated deployment mode, connectivity test is not supported between management nodes. If the source or target type is Virtual Machine, make sure VMPtools is installed on the selected VM and is running correctly.

Manage traffic block logs​

Traffic block logs record information about packets that are blocked by the management platform. These

logs can be used for traffic analysis, attack detection, and network behavior auditing. Additionally, when a communication failure occurs, you can enable traffic bypass to disable all management platform network policies and permit all service traffic to determine whether the failure is caused by network policies.

Restrictions and guidelines

• If you specify an IP address or IP address range to filter traffic block logs, the system matches it against both the source and destination IP addresses of the blocked packets. A traffic block log entry is displayed as long as its source or destination IP address matches the specified criterion.

• If you configure a traffic block policy on a VM port and configure the port as the source port of a port mirror image, the port is not recorded in the traffic block log. This is because packets can be transmitted to the destination port of that port mirror image.

• After a vFirewall is converted to a distributed firewall, due to delay in the traffic block log matching process, the matched block rule for blocked packets might still be displayed as the vFirewall name, even though the distributed firewall rules have already taken effect. This issue will automatically be cleared after a period of time (approximately 1 minute).

View traffic block logs

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > Traffic Block Logging. You can view detailed network log information, including source IP address, destination IP address, destination port, destination MAC address, protocol, time, source MAC address, source port, data packet size (bytes), and matched block rule. For descriptions about these fields, see "Parameters."

Filter traffic block logs

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > Traffic Block Logging.

  3. Enter filter criteria at the top of the page. You can enter an IP address or IP address range, select a protocol, enter a matched block rule, or specify a time range. Alternatively, you can enter multiple filter criteria. When filtering traffic block logs by IP address or IP address range, you can enter a single IP address or IP address range. For example, 192.168.252.1, or 192.168.252.1 to 192.168.252.10.

  4. Click Filter. All traffic block logs that match the filter criteria will be displayed in the list.

Enable traffic block logging

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > Traffic Block Logging.

  3. Click Enable Traffic Block Logging.

Enable data passthrough

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > Traffic Block Logging.

  3. Click Enable Data Passthrough.

  4. Click OK.

Clear traffic block logs

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > Traffic Block Logging.

  3. Click Clear.

  4. Click OK.

Refresh traffic block logs

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > Traffic Block Logging.

  3. You can select a refresh interval on the right of the page.

Disable traffic block logging

  1. On the top navigation bar, click Network.

  2. From the left navigation pane, select Network Maintenance > Traffic Block Logging.

  3. Click Disable Traffic Block Logging.

Parameters

• Source IP: Source IP address of the blocked packet.

• Destination IP: Destination IP address of the blocked packet.

• Destination Port: Destination port of the blocked packet.