Table of Contents
Advertisement
Understanding network link aggregation
When link aggregation is used, traffic from multiple network ports is combined. The combined traffic can be
forwarded to monitoring tools as a single stream of traffic.
Link aggregation combines traffic from multiple network ports into a single stream. The combined traffic
can be forwarded to a tool port. Link aggregation brings traffic together from separate sources or locations
(for instance, from several devices) and forwards the traffic as one stream to a single
aggregation can be enhanced further by using
—aggregated traffic in this case—to be sent to more than one monitoring tool.
Tip!
Aggregation occurs any time multiple network ports are connected to the same instance of a rule.
Use link aggregation for visibility of both sides of a link over a single interface. Consider this example scenario:
your organization has placed a
is a switch with a
SPAN
port. Connect both the TAP analyzer link(s) and the SPAN port link of the switch to the
Matrix. Finally,
assign the links as network ports (page 19)
rule (page
17). Visibility from both sides of a network link is achieved (in front of and behind the firewall) over
one interface—a single tool port.
Avoid aggregating links that are too saturated to aggregate without oversubscribing a tool port. Aggregating
multiple 1 Gb links and forwarding the traffic out a 1 Gb tool port could, in some cases, oversubscribe the tool
port and cause packets to drop. In these cases, you might have to enforce
filtering (page 23)
to lower the utilization enough that packets do not drop. Another strategy is to aggregate less
network links if possible. The best strategy is to ensure any tool port forwarding the aggregate traffic of multiple
1 Gb network ports is a 10 Gb link.
Link aggregation does not create more bandwidth. Regarding the Matrix, link aggregation only refers to
combining traffic into a single interface. The links being aggregated do not experience increased
bandwidth capacity.
Link aggregation does not automatically create link redundancy. Although link aggregation may have a
role in a link redundancy strategy using the Matrix, aggregating network links does not provide any type of
redundancy or high availability. However, if using the Matrix for this purpose, combining link aggregation with
traffic replication (page 32)
malfunctions.
Link aggregation can affect how efficiently connected tools operate. When monitoring tools require great
network visibility to perform efficiently, consolidating the traffic from many locations and sources is valuable
to those tools. Plus, by combining link aggregation with
combined traffic can be forwarded to different analysis tools.
How to perform speed conversion
Speed conversion creates network visibility for slower tools that cannot interface with faster networks, or where
the physical connections are mismatched—like copper and optical. Perform speed conversion so existing tools
can operate in these situations and others, such as combining multiple slower links into a single high speed
interface.
Note:
To edit the active layout (the layout currently in use), perform edits directly from the Ports page. Edits to
the active layout take effect in real time.
Speed conversion follows the same process as connecting a network port to a tool port. There is absolutely no
special configuration required to accomplish speed conversion; these steps are just provided for convenience.
traffic replication (page
network TAP
at the network edge, in front of the firewall. Behind the firewall
can help you forward redundant traffic streams to identical tools in case one tool
32), which allows the same traffic stream
in the Matrix and
connect them to the same layout
packet trimming (page 43)
traffic replication (page
32), the copies of the same
Understanding network link aggregation | 35
monitoring
tool. Link
or
throughput
or
Advertisement
Table of Contents
