Configure local port mirroring + conntrack

 

1.
#enable sriov
echo 2 > /sys/class/net/eth3/device/sriov_numvfs
lspci | grep -i mellanox

2.
#unbind VFs
echo 0000:00:08.2 > /sys/bus/pci/drivers/mlx5_core/unbind
echo 0000:00:08.3 > /sys/bus/pci/drivers/mlx5_core/unbind

3.
#enable switchdev
devlink dev eswitch set pci/0000:00:08.0 mode switchdev

4.
#set VFs mac address
ip link set dev eth3 vf 0 mac e4:11:22:33:44:50
ip link set dev eth3 vf 1 mac e4:11:22:33:44:51

5.
#bind VFs
echo 0000:00:08.2 > /sys/bus/pci/drivers/mlx5_core/bind
echo 0000:00:08.3 > /sys/bus/pci/drivers/mlx5_core/bind

6.
#configure openvswitch
systemctl start openvswitch
ovs-vsctl add-br ovs-sriov
ovs-vsctl set Open_vSwitch . other_config:hw-offload=true
ovs-vsctl set Open_vSwitch . other_config:max-idle=300000
systemctl restart openvswitch

7.
#add representor to OVS
ovs-vsctl add-port ovs-sriov eth3
ovs-vsctl add-port ovs-sriov eth5
ovs-vsctl add-port ovs-sriov eth6
ip link set eth3 up
ip link set eth5 up
ip link set eth6 up

8.
#configure netnamespace
ip netns add net0
ip link set dev eth7 netns net0
ip netns exec net0 ip l
ip netns exec net0 ip addr add 1.1.1.8/24 dev eth7
ip netns exec net0 ip a
ip netns exec net0 ip link set eth7 up

9.
#show ovs flows
ovs-dpctl show
ovs-dpctl dump-flows
ovs-appctl dpctl/dump-flows
ovs-vsctl list Mirror

10.
#eth5/6 are the representor interfaces
ovs-vsctl -- set Bridge ovs-sriov mirrors=@m \
 -- --id=@eth5 get Port eth5 \
 -- --id=@eth6 get Port eth6 \
 -- --id=@m create Mirror name=mirror_test select-dst-port=@eth5 select-src-port=@eth5 output-port=@eth6
ovs-vsctl list Mirror

11.
#conntrack
OVS_BR=ovs-sriov

ovs-ofctl del-flows $OVS_BR

#set arp to behave normally, ip will mark trk and then proceed to table 1
ovs-ofctl add-flow $OVS_BR "table=0,arp,action=normal"
ovs-ofctl add-flow $OVS_BR "table=0,ip,ct_state=-trk,action=ct(table=1)"

#set new ip flows to be committed, and to then behave normally
ovs-ofctl add-flow $OVS_BR "table=1,priority=1,ip,ct_state=+trk+new,action=ct(commit),normal"

#set established ip flows to behave normally
ovs-ofctl add-flow $OVS_BR "table=1,priority=1,ip,ct_state=+trk+est,action=normal"
ovs-dpctl dump-conntrack