Arista EOS TAP Aggregation: Tap and Tool Ports

SPAN sessions mirror a few source ports to one destination and then run out of room. When you need many-to-many visibility — twenty network TAPs feeding ten analytics appliances, with per-tool filtering and VLAN header removal — you want TAP aggregation. Arista EOS implements it natively: tap ports receive the monitored traffic, tool ports replicate it to the tool farm, and tap/tool groups describe which sources feed which destinations. This guide covers the configuration that matters and the mode trap that leaves tool ports error-disabled.

The Concepts: Tap Ports, Tool Ports, Groups, Mode

Why Not Just Use SPAN?

SPAN is the right answer for one source and one destination. It gets awkward the moment the fan-out grows: each session consumes a destination port, filtering options are coarse, a source can be mirrored to only a limited number of destinations, and every new appliance means another session to keep track of. TAP aggregation turns that inside out. A tap port accepts traffic, a tool port emits a copy, and a group describes which taps feed which tools — so twenty taps and ten analysers becomes a table of group memberships instead of twenty separate sessions. The trade-off is that a TAP-aggregation switch is not a switch: in exclusive mode its data ports stop bridging, and you must manage it out of band. If the deployment is genuinely one-to-one, ordinary SPAN is simpler; the machinery here pays off at fan-out.

Step 1: Enable TAP Aggregation Mode

Before any interface mode change makes sense, put the switch into TAP aggregation mode. Exclusive mode is the usual choice for a dedicated visibility switch, because all ports then stop behaving like a normal L2 switch:

switch(config)# tap aggregation
switch(config-tap-agg)# mode exclusive
switch(config-tap-agg)# exit

If the switch is still in switching mode, the next configuration steps will appear to work but the tool ports stay error-disabled — a very common "my configuration did nothing" symptom.

Mode: Exclusive Versus Switching

The mode command under tap aggregation accepts two values and the choice is not cosmetic.

Whichever you pick, put the management path on its own VLAN or its own physical link. In exclusive mode you cannot reach the device through a data port, and discovering that during a change window is expensive: show tap aggregation and show running-config are your only views into what the ports are doing, and both need to be reachable.

Step 2: Configure the Tap Ports

switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport mode tap
switch(config-if-Et1)# switchport tap default group Analysis
switch(config-if-Et1)# description "tap from core uplink"
switch(config-if-Et1)# exit

switchport tap default group <name> sends everything received on that port into the named group. Tap ports can also carry an identity tag and a default group tag, which packet-broker setups use to keep track of which TAP a frame came from.

Tap Identity and Group Tags

Two features are easy to overlook and hard to live without later. A tap port can stamp an identity tag onto the frames it forwards, and it can carry a default group tag. Downstream, a tool port can be told which identity or group tag it will accept, which is how a packet broker, or an analyser that receives several merged copies, tells one TAP apart from another:

interface Ethernet1
   switchport mode tap
   switchport tap identity 2101
   switchport tap default group Analysis
   switchport tap default group tag 9
!
interface Ethernet5
   switchport mode tool
   switchport tool group set Analysis
   switchport tap identity 2101 allowed

Plan the numbering before you need it. A tag is only useful if the tool knows what it means, and "which TAP is 2101?" is a question you want answered from a spreadsheet, not from a packet capture at 3 a.m.

Step 3: Configure the Tool Ports

switch(config)# interface Ethernet5
switch(config-if-Et5)# switchport mode tool
switch(config-if-Et5)# switchport tool group set Analysis
switch(config-if-Et5)# exit

Ethernet and port-channel interfaces are both valid tool ports, so the usual design is to bundle the tool links into a port-channel and hand the whole bundle to the analyser. Several groups can be attached to one interface — for example a single DPI appliance that receives production traffic and a second, filtered copy from another group. When you need per-tool filtering or header manipulation, the tool port also supports allowed-VLAN matching, VLAN tag stripping and packet truncation, all configured in the same interface context.

Port Channels as Tool Ports

An analyser with more than one NIC, or one that needs more than a single link's worth of throughput, should be handed a port-channel rather than a lone port. EOS treats the whole bundle as one tool port and applies the group membership to the bundle:

interface Port-Channel101
   switchport mode tool
   switchport tool group set Analysis
   no shutdown
!
interface Ethernet5
   channel-group 101 mode active
!
interface Ethernet6
   channel-group 101 mode active

Use LACP (mode active) so a half-connected bundle is detected rather than silently forwarding into a dead member. Two design notes: keep every member's speed and MTU identical, and remember that for group purposes the bundle is one logical tool port — attaching the same group to it twice gains nothing and clutters the configuration.

Filtering at the Tool Port

The most valuable property of a TAP-aggregation design is that the switch, not the appliance, does the filtering. A tool port can restrict what it forwards by VLAN, strip VLAN tags so the appliance sees clean frames, and truncate packets to the header length the tool actually inspects:

interface Port-Channel101
   switchport mode tool
   switchport tool group set Analysis
   switchport tool allowed vlan 1001-1020,2000
   switchport tool strip vlan
   switchport tool truncate 128

Send the minimum each appliance needs. An IDS that reads headers does not benefit from full frames, and the difference between mirroring full packets and 128-byte truncations is often the difference between a saturated tool port and a comfortable one. If a tool needs both production traffic and a filtered copy, give it two groups — that is precisely what groups are for.

Step 4: Verify

EOS gives tool-aware display commands, which is the fastest way to prove the port is in the right mode:

switch# show interface port-channel 101-103 tool
Port      Configured     Status         Allowed             Id   Timestamp
          Mode                          Vlans               Tag  Mode
-----------------------------------------------------------------------
Po101     tool           tool           All                 Off  ---
Po102     tool           tool           All                 Off  ---
Po103     tool           tool           All                 Off  ---

switch# show active
interface Port-Channel101
     switchport mode tool
     switchport tap identity 2101
     switchport tool allowed vlan 1001-1020
     switchport tap default group tag-9
     switchport tool group set analyze3 analyze2

Two checks worth adding to any change window: confirm every tap port shows mode tap and every tool port shows mode tool (a mismatch means the tap feeds nothing, or a tool receives nothing), and confirm the tool's own interface counters rise while you generate traffic on the tapped link. show tap aggregation groups is the quickest way to see which taps and tools currently share a group name, and show interfaces status rules out the boring causes — a down link, a speed mismatch, a breakout not split.

Design Notes and Pitfalls

• Keep the visibility switch's management on a separate path — in exclusive mode the data ports are no longer ordinary switch ports.
• Filtering belongs as close to the tool as possible: send the minimum data each appliance needs, because packet brokers and IDS boxes have finite throughput.
• Breakout and speed mismatches are the usual cause of a tool receiving nothing: check show interfaces status before blaming the group configuration.
• Document the group names. Analysis, IDS, Forensics beat Group1, Group2 three months later.
• Do not attach the same tap to two groups that both feed one tool unless you want two copies of every packet.
• Account for licensing and packet-buffer limits if the platform is shared with production roles.

Troubleshooting TAP Aggregation

Change-Window Checklist

1. Capture the current configuration (show running-config) so rollback is a paste, not a rebuild.
2. Confirm the switch is in the intended tap aggregation mode before touching any interface.
3. Verify each tap port's group membership by name against the design document.
4. Confirm tool ports carry the allowed-VLAN, strip and truncate settings the appliance expects.
5. Generate traffic and watch both tap ingress and tool egress counters rise together.
6. Re-run show interface … tool until every port reports the expected configured mode and status.

相关阅读：SPAN、RSPAN 与 ERSPAN：镜像传输怎么选、Arista EOS 排障手册 以及 Arista EOS MLAG 配置指南。

原文链接：Arista EOS User Manual - TAP Aggregation