Enterprise Edge Routing Reference Design Guide: Deploying Port Mirroring SPAN RSPAN Configuration

EXECUTIVE SUMMARY

The exponential growth of east-west traffic within enterprise data centers and carrier-grade edge networks demands ubiquitous, high-fidelity visibility without compromising forwarding performance. The implementation of Port Mirroring (SPAN) and Remote SPAN (RSPAN) on our next-generation switching and routing platforms provides network architects with a non-intrusive, hardware-accelerated monitoring foundation. This document serves as the official technical datasheet and architectural overview for deploying SPAN/RSPAN across the access, aggregation, and core layers. Leveraging purpose-built ASIC resources, our solution ensures that mirrored traffic—whether to local or remote analyzers—has zero measurable impact on the production forwarding plane.

ARCHITECTURE & CHASSIS DESIGN

The SPAN (Switched Port Analyzer) and RSPAN (Remote SPAN) feature set is deeply integrated into the parallel switching fabric of all carrier-grade line cards. Unlike software-based probes that introduce latency and packet loss, our hardware mirroring engines operate at line rate.

\(a\) LOCAL SPAN: Traffic from one or multiple source ports (or VLANs) is copied to a local destination port where a physical analyzer (e.g., IDS/IPS, NetFlow collector) is attached.

\(b\) RSPAN: Source traffic is mirrored into a dedicated RSPAN VLAN that transports the mirrored frames across Layer 2 trunk links to a remote switch, where the egress RSPAN destination port delivers the traffic to an analyzer. This enables centralized monitoring across geographically separated IDF/MDF nodes without requiring direct fiber from every source to the analyzer.

HARDWARE FEATURES

– ASIC-BASED MIRRORING: Dedicated mirroring ternary content-addressable memory (TCAM) entries per forwarding engine.
– FLEXIBLE SOURCE SELECTION: Physical ports, port-channels (LAG), or full VLANs (VSPAN).
– MULTIPLE SESSIONS: Support for up to 128 concurrent mirroring sessions on high-end chassis, with bi-directional or single-direction (ingress/egress) granularity.
– TRAFFIC TRUNCATION: Hardware-based packet truncation (64-1518 bytes) to reduce bandwidth consumption on monitoring links.
– ENCAPSULATION: RSPAN supports dot1q VLAN tagging to preserve original frame integrity across transport domains.

COMPLIANCE & STANDARDS

– IEEE 802.1Q (VLAN Tagging for RSPAN)
– RFC 2544 (Performance benchmarking methodology for mirrored traffic)
– RoHS & WEEE (Environmental compliance)
– GR-1089-CORE (NEBS Level 3 for carrier variants)

TECHNICAL SPECIFICATIONS

ORDERING OPTIONS

For production deployments requiring distributed monitoring, we offer three tiered hardware platforms:

1. COMPACT EDGE SWITCH (Model ES-124X-M): 24x 1G/10G SFP+ ports, 2x 40G uplinks. Supports 4 concurrent SPAN/RSPAN sessions. Ideal for branch RSPAN aggregation.

2. AGGREGATION CHASSIS (Model AGC-48Y4C): 48x 25G SFP28, 4x 100G QSFP28. Hardware truncation and 128-session support. Primary choice for data center TOR/AIR implementations.

3. CARRIER ROUTING PLATFORM (Model CRP-10K): Modular 10-slot chassis with 1+1 fabric redundancy. Supports line-rate egress RSPAN from any line card to any other slot.

Each unit includes the full Advanced Monitoring Feature License as standard. No per-port or per-session licensing fees.