configure ens224 interface as an RSPAN destination

[vmsysadm]

Hi all,

hope this is the right place to post this question, if not, please point me to the right place.

I have a new install of SO 2.4.40 deployed in vSphere environment and would like to use it as a destination for a Remote L3 Span. My understanding is that I need an IP address on the monitor interface ens224 to be the destination for the RSPAN.

I used nmcli to add the IP address to ens224 and it looks good. It is also listed in bond0.

nmcli connection modify ens224 ipv4.method manual ipv4.addresses '10.70.1.3/24'

ifconfig ens224
ens224: flags=2499<UP,BROADCAST,RUNNING,NOARP,PROMISC,SLAVE> mtu 9000
inet 10.170.1.3 netmask 255.255.255.0 broadcast 10.170.1.255
inet6 fe80::250:56ff:fe90:2235 prefixlen 64 scopeid 0x20
ether 00:50:56:90:22:35 txqueuelen 1000 (Ethernet)
RX packets 17487 bytes 3346541 (3.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1 bytes 62 (62.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v5.15.0-202.135.2.el9uek.x86_64

Bonding Mode: load balancing (round-robin)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0
Peer Notification Delay (ms): 0

Slave Interface: ens224
MII Status: up
Speed: 10000 Mbps
Duplex: full
Link Failure Count: 0
Permanent HW addr: 00:50:56:90:22:35
Slave queue ID: 0

If I do "tcpdump -i bond0", I can see the GRE-encapsulated RSPAN traffic, but after a few minutes, the traffic stops...

If I run:
nmcli connection up ens224
ifenslave bond0 ens224

then tcpdump shows GRE traffic again...

I would appreciate any suggestions on how to set this up.

[vmsysadm]

It looks like there is a problem with gratuitous ARP on ens224, it does not respond to the query:

tcpdump -en -i ens224
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on ens224, link-type EN10MB (Ethernet), snapshot length 262144 bytes
21:57:08.098445 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46
21:57:08.139270 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46
21:57:09.189416 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46
21:57:10.098563 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46
21:57:10.189145 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46
21:57:11.098330 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46
21:57:11.190573 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46
21:57:12.190623 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46

it's not working even if I do "ifconfig ens224 arp"
ifconfig ens224
ens224: flags=2371<UP,BROADCAST,RUNNING,PROMISC,SLAVE> mtu 9000
inet 10.70.1.3 netmask 255.255.255.0 broadcast 10.70.1.255
inet6 fe80::250:56ff:fe9e:5153 prefixlen 64 scopeid 0x20
ether 00:50:56:9e:51:53 txqueuelen 1000 (Ethernet)
RX packets 899540 bytes 509242914 (485.6 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 10 bytes 616 (616.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

tcpdump -en -i ens224
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on ens224, link-type EN10MB (Ethernet), snapshot length 262144 bytes
22:00:09.098808 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46
22:00:09.721718 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46
22:00:10.771113 02:50:56:56:44:62 > Broadcast, ethertype ARP (0x0806), length 60: Request who-has 10.70.1.3 tell 10.70.1.1, length 46

[vmsysadm]

Turns out the bond slaves can't do ARP and the IP address had to be set on the bond0 instead of the ens224.

nmcli connection modify bond0 ipv4.method manual ipv4.addresses '10.70.1.3/24'

Now everything works and the RSPAN traffic is seen on the monitor interface, and the SO processing the packets.