Distributed Port Mirroring not working when session type "Distributed Port Mirroring" is used

Products

• VMware vCenter Server

Issue/Introduction

• Distributed Port Mirroring sessions fail or stop forwarding mirrored packets when the source and/or destination ports are configured on different ESXi hosts.
• It is observed that a port mirroring session, configured with the session type "Distributed port mirroring," intermittently or entirely stops working when the source distributed port and the destination distributed port resides on different ESXi hosts.

Environment

VMware ESXi 8.x

VMware vCenter Server 8.x

Cause

The Distributed Port Mirroring session type within the vSphere Distributed Switch (vDS) is designed to handle traffic mirroring only when the source and destination ports are local to the same ESXi host.

If a source or destination VM is migrated via vMotion, resulting in the source and destination being separated onto different ESXi hosts, the session breaks because the vDS local mirroring mechanism cannot span the physical host boundary.

Resolution

To successfully mirror traffic between distributed ports that may span multiple ESXi hosts or are intended to be forwarded to a remote monitoring tool, the session type must be changed to Encapsulated Remote Mirroring (L3) Source.

1. Delete the existing non-functional Distributed Port Mirroring session.
2. Create a new Port Mirroring session on the vSphere Distributed Switch.
3. Set the session type to Encapsulated Remote Mirroring (L3) Source.
4. Choose anyone of the encapsulation type (GRE / ERSPAN 2 / ERSPAN 3) depending on which is best recommended by your monitoring application.
5. Configure the Sources (the VMs whose traffic you wish to mirror).
   • Important Note : Do NOT select the VMK0 port as the source, as this can lead to network loops or stability issues.
6. Configure the Destination IP: Specify the IP address of a remote collector or agent that will receive the mirrored packets.
7. The vDS will then encapsulate the mirrored packets in an IP tunnel (L3) and forward them to the specified IP address, allowing the mirroring to work reliably even when the source VM is migrated between hosts.

Additional Information

• Port Mirroring Interoperability
• Create a Port Mirroring Session