[QFX] How to prevent asymmetric hashing when Passive Monitoring is used

Summary:

This article explains how to prevent asymmetric hashing in layer 2 traffic when the Passive Monitoring feature is used in a complex setup in QFX Series switches.

Symptoms:

When multiple switches send traffic to QFX/PTX devices wherein passive monitoring is used, it is possible that some devices may add VLAN tags to the traffic before exporting to other QFX/PTX devices.

This behavior may impact the way hashing is done before the QFX/PTX devices send traffic to the IDS Servers that are connected with the link aggregation interfaces, thus causing problems in the stateful inspection of these IDS Servers.

For instance, this behavior may cause the QFX/PTX devices to send traffic from the same flow to different IDS Servers, thus defeating the usage and purpose of the Passive Monitoring feature.

Solution:

In order to prevent asymmetric hashing when passive monitoring is used, add the following configuration:

[edit]
user@switch#
set forwarding-options enhanced-hash-key layer2 no-vlan-id

Use the following configuration for hashing:

[edit]

user@switch#

set forwarding-options enhanced-hash-key layer2 no-vlan-id
set forwarding-options enhanced-hash-key inet no-incoming-port

Verify Symmetric Hashing

Verify the output for symmetric hashing. The incoming port fields for inet, inet6, and L2 should all be set to No. Also, in L2 Settings, vlan-id should be set to No.

In configuration mode, enter the show forwarding-options enhanced-hash-key command and verify the output.

Slot 0

Seed value for Hash function           0: 3626023417
Seed value for Hash function           1: 3626023417
Seed value for Hash function           2: 3626023417
Seed value for Hash function           3: 3626023417

    Inet settings:
    --------------
        IPV4 dest address:    Yes
        IPV4 source address:  Yes
        L4 Dest Port:         Yes
        L4 Source Port:       Yes
Incoming port:        No
    Inet6 settings:
    --------------
        IPV6 dest address:    Yes
        IPV6 source address:  Yes
        L4 Dest Port:         Yes
        L4 Source Port:       Yes
Incoming port:        No
    L2 settings:
    ------------
        Dest Mac address:    No
        Source Mac address:  No
        Vlan Id:             No
        Inner-vlan Id:       No
        Incoming port:       No
    GRE settings:
    -------------
        Key:                 No
        Protocol:            No
    MPLS settings:
    --------------
    MPLS Enabled:        Yes

    VXLAN settings:
    ---------------
        VXLAN VNID:          No

Knowledge Base