- [Man] Now we want to take a look at configuring
ERSPAN or Encapsulated Remote SPAN.
If you have a really large multi-site environment,
this is going to a great solution
for monitoring those remote sites over WAN connections.
ERSPAN allows you to route SPAN traffic
to other areas of a network through Layer 3 IP routing.
This configuration is similar for that of RSPAN,
but there are a few additional command requirements.
Here, you can see from our topology on screen,
we have two networks separated by a router.
One of those is VLAN 123 for the 10.1.1.0/24 network,
and the other is VLAN 456 for the 20.1.1.0/24 network.
We have one switch and a host connected to that switch.
Switch one is going to model the Main Office Branch,
where we would have a Traffic Analyzer attached
and we would likely have many other hosts there too as well
if this was an actual Main Office.
While switch two, that's going model a Remote Office
and those hosts found over there.
Now, you'll want to note that ERSPAN isn't supported
on every single Cisco switch.
It's a fairly high end feature found on things like
the Cisco Nexus and Catalyst 4500 series switches.
In this instance,
switch one is already configured for local SPAN,
so it's collecting data related to the attached host
and it's sending that out
to the Traffic Analyser destination
that's locally attached.
We're going to be configuring switch two in this case.
So we're connected there,
let's go under Global Configuration Mode
and just as with Local and Remote SPAN,
we need need to designate a source and a destination.
So let's say monitor session,
and the first thing we want to do
is we want to give that a SPAN session number.
In this case, I'm going to make that two
and if we look at contextual help again,
now we can indicate what type of SPAN we're using.
If we look at those options on the output,
we can see all three SPAN versions here.
We see Local SPAN, RSPAN, and ERSPAN.
And just as with other types,
we need to specify the source and the destination.
So let's start with the source
by saying ERSPAN-source
and if we hit Enter,
we're now under ERSPAN Source Configuration Mode.
From there, if we check our contextual help options again,
I like to use the description command
just because that allows me
to give a very descriptive name to that,
that's really easily identifiable later
if I'm looking at the output of my show config commands.
So I'm going to say, description,
and I'm going to name that something very intuitive,
VLAN 456
ERSPAN.
If I hit Enter, that's going to accept that command
and now from those options above
in our previous contextual help output,
let's use the source key word
and if we look at that,
we can set that to either an interface or a VLAN,
among other things.
In this case, I'm going to say interface
and the interface for my source on this switch,
which you can see in the topology diagram, is gig 2
and now if we look at contextual help again,
we see more options.
We can configure this for send, for receive, or for both.
We can also specify a range of interface ports
or we can add additional individual ports,
or we can even add several non-contiguous ranges.
In my case, I'm not going to do any of that,
I'm just going to accept this single port
but I am going to use the Rx key word
to configure this to monitor only received traffic.
I'm going to hit Enter to receive that command.
If I look at those contextual help options again,
something you might have noticed,
in a previous video that we haven't used yet,
is the Filter keyword.
This is going to allow us to associate
the ERSPAN's source session with specific VLANs.
So, you'll want to remember that you cannot source VLANs
and filter VLANs in the same session.
You can do either-or, but not at the same time.
So here, we're going to specifically want
VLAN 456 as our source.
So we can say filter VLAN 456
and hit Enter.
So that completes our Source Configuration.
Let's configure the destination now,
we can do that by using the keyword Destination
to go under this configuration mode
and from the textual help,
we can see the first thing we might want to do
is configure an ERSPAN ID.
This ID is going to be used by the source
and destination sessions, to identify the ERSPAN traffic.
So I'll say ERSPAN-ID
and contextual help tells us
that this needs to be a numerical value between 1 and 1023,
in my case, I'm just going to make that 1
and hit Enter to accept that.
Now, we want to use the IP option
to point that to an IP address.
Specifically, we want to point that to the IP address
for the destination where the traffic is going to be sent
to be analyzed.
In our case, that is 10.1.1.5.
So I'll say IP address 10.1.1.5.
And I'll hit Enter.
Now, another option we want to configure is the origin.
So we can use the origin keyword,
and here we want to indicate the IP address
that's going to be used as the source of our ERSPAN traffic.
So I'll say origin, IP address,
and that's going to be 20.1.1.2.
One more thing that's optional,
but it's recommended, is to set the TTL value.
That's going to limit the reach
of these ERSPAN packets within our network.
And that's just a precautionary measure.
So I'm going to set that to 32 in this case,
by saying IP TTL 32.
I'm going to hit Enter,
and we'll end and break out of there.
Now we can take a look at our configuration,
we can say show monitor session
ERSPAN-source
and now we can see everything that we've configured,
we can see the description that we've created,
which is VLAN 456 ERSPAN,
we can see that we are set to receive only,
by the RX Only indication on the Gig 2 interface,
we can see the destination for the ERSPAN traffic,
which is our server at 10.1.1.5,
we can see our Origin IP Address,
which is the local IP address here on this device,
and we see the TTL that we configured of 32.
Now one curious thing you might have noticed
is that the status is set to Admin Disabled.
So one unique thing about ERSPAN
is that you need to run a no shutdown command
in order to actually enable this.
So let's go back under Global Configuration mode,
We'll go back under our session
by saying monitor session and that was session number two.
And we'll say no shut.
We'll end that, we'll run that command again,
the show monitor session ERSPAN source.
And now we see the the status is set to Admin Abled,
so that's exactly what we want to see.
So that's a look at configuring Encapsulated Remote SPAN,
or ERSPAN, used for moving remote SPAN traffic
through layer three routing.