NSX Remote L3 Span Port Mirroring

Products

• VMware NSX

Issue/Introduction

• Need to mirror traffic from one VM to another
• NSX segments in use are VLAN backed segments
• Configured Port mirroring in Plan & Troubleshoot > Port Mirroring in NSX
• Profile Type > Remote L3 Span, Direction > Ingress, and TCP/IP Stack > Default
• Unable to see the mirrored traffic on the destination VM

Environment

VMware NSX

 

Cause

• Port mirroring Direction is configured as Ingress instead of Egress
• In vSphere/Port Mirroring, ingress means traffic entering the vDS (traffic leaving the virtual machine) and egress means traffic leaving the vDS (traffic entering the virtual machine)
• Firewall rules can prevent the mirrored traffic entering the destination VM

Resolution

• Configure the port mirroring direction as Egress in order for the mirrored traffic to be seen at the destination VM
• Ensure there are no firewall rules assigned to the destination VM that would block the mirrored traffic

Additional Information

• To add a port mirroring session, see  Add a Port Mirroring Session
• To understand how the traffic direction for port mirroring sources functions in vSphere Distributed Switches, see Port Mirroring Session Traffic Direction Appears to be Reversed in Distributed Switches