DMF 8.6.0 TOI

Previously, sending Watcher alerts to email required editing configuration files in the command line and restarting the Elasticsearch container.  An update to the Watcher alerts feature creates a simpler configuration method using the Analytics Node UI and supports sending Watcher alerts to remote Syslog servers.

The DANZ Monitoring Fabric (DMF) Application Identification feature allows monitoring of applications identified from packets taken from filter interfaces and sent through the fabric by sending IPFIX reports to a collector. The feature provides a filtering function by forwarding or dropping packets from specific applications before sending the packet to the analysis tools.

In DANZ Monitoring Fabric (DMF) 8.6, the Controller supports modular chassis switches. A chassis can have one or more line cards. On the Controller side, a chassis switch with multiple line cards, each with its own ASIC, will be treated as a single switch. When connected, the chassis should work like any regular switch and requires no user intervention for this support to work. The Controller will automatically pick up the chassis, initiate a handshake, and react to any chassis events like line cards added or removed.

In a typical CloudVision-DMF integration deployment, CloudVision Portal (CVP) deploys alongside the DANZ Monitoring Fabric (DMF). The DMF Controller communicates with CVP to retrieve its managed device inventory and configures port mirroring sessions on any CVP-managed production devices that are Arista Extensible Operating System (EOS) switches.

This document describes the updates to the DANZ Monitoring Fabric (DMF) 8.6 release verified scale and performance numbers. 1) For 7280R3 series switches and higher, the TCAM scale values increased from 6K to 8K.

The hardware support update details newly supported hardware and other changes in the DANZ Monitoring Fabric (DMF) release 8.6.0.

The DANZ Monitoring Fabric (DMF) Controller in Azure feature supports the operation of the Arista Networks DMF Controller on the Microsoft Azure platform and uses the Azure CLI or the Azure portal to launch the Virtual Machine (VM) running the DMF Controller.

The DANZ Monitoring Fabric (DMF) Controller in Google Cloud Vmware Engine (GCVE) supports the operation of the Arista Networks DMF Controller on the GCVE platform and uses the vCenter portal to launch the Virtual Machine (VM) running the DMF Controller.

Before the DANZ Monitoring Fabric (DMF) 8.6 release, DMF performed filtering at the filter port based on policy match rules. Thus, the system delivered the same traffic to all policy deliveries and tools associated with those delivery ports.

DMF 8.6 introduces a re-designed LAGs Page with an improved workflow and additional functionality.

DANZ Monitoring Fabric (DMF) 8.6 introduces a newly designed API Inspector available on all DMF UI pages. Previously, the former API Inspector was accessible by selecting the Dragonfly icon, but it was only available on some pages.

The DANZ Monitoring Fabric (DMF) Drop Differ Dashboard and Latency Differ Dashboard feature provides a near real-time visual representation of latency and drops in the DMF Analytics Node (AN) dedicated to NetFlow Records.

Destination MAC rewrite for the records-per-interface NetFlow and IPFIX feature becomes the new default setting and applies to EOS and SWL. A configuration option exists for using src-mac when overwriting the dst-mac isn't preferred.

Latency and drop information help determine if there is a loss in a particular flow and where the loss occurred. A Service Node action configured as a DANZ Monitoring Fabric (DMF) managed service has multiple separate taps or spans in the production network and can measure the latency of a flow traversing through any pair of these points. It can also detect packet drops between any two points in the network if the packet only appears on one point within a specified time frame, currently set to 100ms.

Permitting DANZ Monitoring Fabric (DMF) interface names to contain forward slashes (/) aids in managing interfaces in the DMF fabric.

DANZ Monitoring Fabric (DMF) vCenter integration supports mirroring from vCenter hosts using the default TCP/IP stack. However, this can result in traffic drops and affect production traffic since mirror traffic can conflict with production traffic. DMF vCenter integration with Mirror Stack provides the functionality to use the mirror TCP/IP stack for mirror sessions. Mirror stack in the ESXi host allows decoupling the traffic and keeps the production traffic unaffected.

This feature supports Link Aggregation Group (LAG) use in the tunnel endpoint configuration.

When some LAG member links go down, it may be preferable to isolate the filter switch by bringing down the entire LAG interface rather than delivering unreliable data to tools and devices. Two new commands are now part of the DANZ Monitoring Fabric (DMF) lag-interface configuration to aid in managing the LAG interface when a specified number of links go down.

Match VMware vCenter-specific information in the policy. Specifically, this feature matches traffic using VMware vCenter Virtual Machine (VM) names.

The Recorder Node (RN) recording statistics API on the DANZ Monitoring Fabric (DMF) Controller has been extended to include information about the operational state of the ongoing recording.

For an active/standby cluster configuration, the user can reload or reboot the node. When the active node is reloaded or rebooted, the standby node becomes the new active node. When the user logs in to the Virtual IP of an active/standby cluster configuration, the user can reload or reboot the active node. The Virtual IP (VIP) logs in to the new active node without the user changing IP addresses. The new standby node will not have the reload or reboot functionality unless that node is directly logged into by the user.

The use-service-delivery option in use-managed-service was originally part of the service action chaining feature. It needed to be set to true when using service actions requiring a delivery interface set in the associated managed service configuration. 

Session slicing (4-tuple) is a feature in DANZ Monitoring Fabric (DMF) that tracks TCP and now UDP sessions.  Configure a managed service on a Service Node specifying the packet count, after which the Service Node will start dropping the packets and stop forwarding them to tool nodes.

DANZ Monitoring Fabric (DMF) 8.6 provides the initial support for the 7050DX4/PX4 for Early Field Trial (EFT). As such, not all features are currently available. Refer to the Limitations section at the end of this TOI.

As a result of upgrading the Debian distribution to Bookworm, the original Python CLI (based on python2) was removed, as the interaction with the DANZ Monitoring Fabric (DMF) and CCF is performed mainly from the Controller. However, several customer operations involve some of the commands used on the switch. These commands are implemented in the new CLI (based on python3) in Switchlight in the Bookworm Debian distribution.

Prior email alerts in the Analytics Node System tab didn’t use secure protocols like TLS or SSL. This feature enables secure email alerts.

Virtual Extensible LAN (VXLAN) Header Stripping supports the delivery of decapsulated packets to tools and devices in a DANZ Monitoring Fabric (DMF) fabric.  This feature removes the VXLAN header, previously established in a tunnel for reaching the TAP Aggregation switch or inherent to the tapped traffic within the DMF.

This document addresses Virtual Extensible LAN (VXLAN) hashing capabilities and behavior specifically on the DCS-7280 platforms.