Network Management Configuration Guide, Cisco Catalyst IE9300 Rugged Series Switches

PDF

Network Management Configuration Guide, Cisco Catalyst IE9300 Rugged Series Switches

Troubleshoot ERSPAN

Updated: November 20, 2023

Want to summarize with AI?

Log in

Explains how to configure Encapsulated Remote Switched Port Analyzer (ERSPAN) using debug commands to troubleshoot issues and capture network traffic in real-time.

ERSPAN configuration is a process that

  • enables troubleshooting of Encapsulated Remote Switched Port Analyzer (ERSPAN) issues using debug commands,

  • captures and displays network traffic in real-time on specific network device interfaces, and

  • uses specific debug commands to monitor and analyze network traffic.

Available debug commands

You can use these commands to configure ERSPAN:

  • debug monitor ERSPAN

  • debug monitor capture

Configure an ERSPAN source session

Configure an ERSPAN source session to enable monitoring of specific ports or VLANs by defining session parameters and traffic direction settings.

The ERSPAN source session defines the session configuration parameters and identifies the ports or VLANs to monitor. Complete the steps below to configure an IPv4 ERSPAN source session.

Procedure

1.

Use the enable command to enter privileged EXEC mode.

Example:

Device> enable
2.

Use the configure terminal command to enter global configuration mode.

Example:

Device# configure terminal
3.

Use the monitor session span-session-number type ERSPAN-source command to create the ERSPAN source session and enter ERSPAN source session configuration mode.

Example:

Device(config)# monitor session 1 type erspan-source

  • The span-session-number argument range is from 1 to 66. The session number must be unique across both source and destination sessions. After the session ID and session type are configured, use the no form of this command to remove the session and then re-create the session, with a new session ID or a new session type.

4.

(Optional) Use the description string command to describe the ERSPAN source session. Use the [no] header-type 3 command to configure Type-III ERSPAN header, if required.

Example:

Device(config-mon-erspan-src)# description source1
Device(config-mon-erspan-src)# header-type 3

The description string can be up to 240 characters long, excluding spaces or special characters. The default ERSPAN header type is Type II
5.

Use the source {interface interface-type interface-number | vlan vlan-id} [, | - | both | rx | tx] command to configure the source interface or VLAN and the traffic direction to monitor.

Example:

Device(config-mon-erspan-src)# source interface GigabitEthernet1/0/1 rx
6.

(Optional) Use the filter {IP access-group {standard-access-list | expanded-access-list | acl-name } | mac access-group acl-name | sgt sgt-id [, | -] | vlan vland-id [, | -]} command to configure filtering for the ERSPAN source session.

Example:

Switch(config-mon-erspan-src)# filter vlan 3

(Optional) Configures source VLAN filtering when the ERSPAN source is a trunk port.

Note
You cannot include source VLANs and filter VLANs in the same session.
7.

Use the destination command to enter ERSPAN source session destination configuration mode. Then use the erspan-id erspan-flow-id command to configure the ERSPAN flow ID.

Example:

Device(config-mon-erspan-src)# destination
Device(config-mon-erspan-src-dst)# erspan-id 100

The ERSPAN ID identifies the ERSPAN traffic and must match the ERSPAN ID configured on the destination session.

Optional settings include ip dscp dscp-value, ip ttl ttl-value, and vrf vrf-id. Use mtu mtu-size to configure truncation; the MTU range is 176 to 9000 bytes, and the default is 9000 bytes. Use origin ip address ip-address to configure the source IP address for the ERSPAN traffic.
8.

Use the ip address ip-address to configure the destination IP address for ERSPAN traffic. You can also configure optional settings such as ip dscp dscp-value, ip ttl ttl-value, and vrf vrf-id. Use the MTU mtu-size command to configure truncation. Use the origin ip-address ip-address command to configure the source IP address for the ERSPAN traffic.

Example:

Device(config-mon-erspan-src-dst)# ip address 192.0.2.1
Device(config-mon-erspan-src-dst)# ip dscp 10
Device(config-mon-erspan-src-dst)# ip ttl 32
Device(config-mon-erspan-src-dst)# mtu 512
Device(config-mon-erspan-src-dst)# origin ip address 198.51.100.1
Device(config-mon-erspan-src-dst)# vrf 1

The MTU size values range from 176 to 9000 bytes, with a default of 9000 bytes.
9.

Use the exit , no shutdown , and end commands to exit destination configuration mode, enable the ERSPAN session, and return to privileged EXEC mode.

Example:

Device(config-mon-erspan-src-dst)# exit
Device(config-mon-erspan-src)# no shutdown
Device(config-mon-erspan-src)# end

Configure an ERSPAN destination session

Configure an ERSPAN destination session to specify which ports receive monitored traffic, so you can monitor and analyze your network.

The ERSPAN destination session defines the session configuration parameters and the ports that receive the monitored traffic. To define an IPv4 ERSPAN destination session, complete this procedure:

Procedure

1.

Use the enable command to enter privileged EXEC mode.

Example:

Device> enable
2.

Use the configure terminal command to enter global configuration mode.

Example:

Device# configure terminal
3.

Use the monitor session session-number type ERSPAN-destination command to define an ERSPAN destination session using the session ID and the session type, and enter ERSPAN monitor destination session configuration mode.

Example:

Device(config)# monitor session 1 type erspan-destination

  • The session-number argument range is from 1 to 66. Each session number must be unique and cannot be reused.

  • Each session ID must be globally unique for both source sessions and destination sessions, because they share the same global ID space.

  • After entering the session ID and session type, you cannot change them. To modify these settings, use the no form of this command and then create a new session with the desired session ID or session type.
4.

Use the description string command to describe the ERSPAN destination1 session.

Example:

Device(config-mon-erspan-dst)# description source1
Enter a string up to 240 characters without special characters or spaces.
5.

Use the destination interface interface-type interface-number command to assign the destination interface to the ERSPAN session.

Example:

Device(config-mon-erspan-dst)# destination interface GigabitEthernet1/0/1
6.

Use the source command to enter ERSPAN destination session source configuration mode.

Example:

Device(config-mon-erspan-dst)# source
7.

Use the erspan-id erspan-flow-id command to configure the ID used by source and destination sessions to identify ERSPAN traffic. You must also enter this ID in the ERSPAN source session configuration.

Example:

Device(config-mon-erspan-dst-src)# erspan-id 100
8.

Use the ip address ip-address [force] command to configure the IP address that is used as the destination of the ERSPAN traffic.

Example:

Device(config-mon-erspan-dst-src)# ip address aaa.bbb.ccc

  • This IP address must be an address on a local interface or loopback interface, and match the address on the destination switch.

  • The ip address ip-address force command changes the destination IP address for all ERSPAN destination sessions.

(Optional) Use the vrf vrf-id command to configure the VRF name instead of the global routing table.

Example:

Device(config-mon-erspan-dst-src)# vrf 1

Use the no shutdown command to enable the configured sessions on an interface

Example:

Device(config-mon-erspan-dst-src)# no shutdown
9.

Use the end command to exit ERSPAN destination session source configuration mode, and return to privileged EXEC mode.

Example:

Device(config-mon-erspan-dst-src)# end

Configuration examples for ERSPAN

The following sections provide configuration examples for ERSPAN.

ERSPAN source session configuration example

This example shows how to configure an ERSPAN source session.

Device> enable
Device# configure terminal
Device(config)# monitor session 1 type erspan-source
Device(config-mon-erspan-src)# description source1
Device(config-mon-erspan-src)# source interface GigabitEthernet 1/0/1 rx
Device(config-mon-erspan-src)# source interface GigabitEthernet 1/0/4 - 8 tx
Device(config-mon-erspan-src)# source interface GigabitEthernet 1/0/3
Device(config-mon-erspan-src)# destination
Device(config-mon-erspan-src-dst)# erspan-id 100
Device(config-mon-erspan-src-dst)# ip address 10.1.0.2
Device(config-mon-erspan-src-dst)# ip dscp 10
Device(config-mon-erspan-src-dst)# ip ttl 32
Device(config-mon-erspan-src-dst)# mtu 512
Device(config-mon-erspan-src-dst)# origin ip address 10.10.0.1
Device(config-mon-erspan-src-dst)# vrf monitoring
Device(config-mon-erspan-src-dst)# exit
Device(config-mon-erspan-src)# no shutdown
Device(config-mon-erspan-src)# end

Configure an ERSPAN destination session

This section provides configuration examples for ERSPAN destination sessions, including basic configuration and configuration with source VRF.

Basic ERSPAN destination session configuration

This example shows how to configure an ERSPAN destination session:

Device(config)# monitor session 1 type erspan-destination
Device(config-mon-erspan-dst)# destination interface GigabitEthernet1/0/11
Device(config-mon-erspan-dst)# destination interface GigabitEthernet1/0/1
Device(config-mon-erspan-dst)# source
Device(config-mon-erspan-dst-src)# erspan-id 100
Device(config-mon-erspan-dst-src)# ip address 10.1.0.2

ERSPAN destination session with source VRF

This example shows how to configure a source VRF for an ERSPAN destination session:

Device(config)# monitor session 1 type erspan-destination
Device(config-mon-erspan-dst)# destination interface GigabitEthernet1/0/11
Device(config-mon-erspan-dst)# destination interface GigabitEthernet1/0/1
Device(config-mon-erspan-dst)# source
Device(config-mon-erspan-dst-src)# erspan-id 100
Device(config-mon-erspan-dst-src)# ip address 10.1.0.2
Device(config-mon-erspan-dst-src)# vrf 1

Verify ERSPAN

To verify the ERSPAN configuration, use these commands.

This is sample output from the show monitor session command:

Device# show monitor session 53

Session 53
----------
Type                     : ERSPAN Source Session
Status                   : Admin Enabled
Source Ports             : 
MTU                      : 9000

This is sample output from the show platform software monitor session command:

Device# show platform software monitor session 53

Span Session 53 (FED Session 0):
Type: ERSPAN Source
Prev type: Unknown
Ingress Src Ports:
Egress Src Ports: 
Ingress Local Src Ports: (null)
Egress Local Src Ports: (null)
Destination Ports: 
Ingress Src Vlans:
Egress Src Vlans: 
Ingress Up Src Vlans: (null)
Egress Up Src Vlans: (null)
Src Trunk filter Vlans:
RSPAN dst vlan: 0
RSPAN src vlan: 0
RSPAN src vlan sav: 0
Dest port encap = 0x0000
Dest port ingress encap = 0x0000
Dest port ingress vlan = 0x0
SrcSess: 1 DstSess: 0 DstPortCfgd: 0 RspnDstCfg: 0 RspnSrcVld: 0
DstCliCfg: 0 DstPrtInit: 0 PsLclCfgd: 0
Flags: 0x00000000
Remote dest port: 0 Dest port group: 0
FSPAN disabled
FSPAN not notified
ERSPAN Id : 0
ERSPAN Org Ip: 0.0.0.0
ERSPAN Dst Ip: 0.0.0.0
ERSPAN Ip Ttl: 255
ERSPAN DSCP : 0
ERSPAN MTU : 1500 >>>>
ERSPAN VRFID : 0
ERSPAN State : Disabled
ERSPAN Tun id: 61
ERSPAN header-type: 2
ERSPAN SGT :

This is sample output from the show monitor session ERSPAN-source detail command:

Device# show monitor session erspan-source detail

Type                     : ERSPAN Source Session
Status                   : Admin Enabled
Description              : -
Source Ports             : 
    RX Only              : None
    TX Only              : None
    Both                 : None
Source Subinterfaces     : 
    RX Only              : None
    TX Only              : None
    Both                 : None
Source VLANs             :
    RX Only              : None
    TX Only              : None
    Both                 : None
Source Drop-cause        : None
Source EFPs              :
    RX Only              : None
    TX Only              : None
    Both                 : None
Source RSPAN VLAN        : None
Destination Ports        : None
Filter VLANs             : None
Filter SGT               : None
Dest RSPAN VLAN          : None
IP Access-group          : None
MAC Access-group         : None
IPv6 Access-group        : None
Filter access-group  :None
smac for wan interface   : None
dmac for wan interface   : None
Destination IP Address   : 192.0.2.1
Destination IPv6 Address : None
Destination IP VRF       : None
MTU                      : 1500
Destination ERSPAN ID    : 251
Origin IP Address        : 10.10.10.216
Origin IPv6 Address      : None
IP QOS PREC              : 0
IPv6 Flow Label          : None
IP TTL                   : 255
ERSPAN header-type       : 3

This output from the show capability feature monitor ERSPAN-source command displays information about the configured ERSPAN source sessions:

Device# show capability feature monitor erspan-source

ERSPAN Source Session:ERSPAN Source Session Supported: TRUE
No of Rx ERSPAN source session: 8
No of Tx ERSPAN source session: 8
ERSPAN Header Type supported: II and III
ACL filter Supported: TRUE
SGT filter Supported: TRUE
Fragmentation Supported: TRUE
Truncation Supported: FALSE
Sequence number Supported: FALSE
QOS Supported: TRUE

This output from the show capability feature monitor ERSPAN-destination command displays all the configured global built-in templates:

Device# show capability feature monitor erspan-destination

ERSPAN Destination Session:ERSPAN Destination Session Supported: TRUE
Maximum No of ERSPAN destination session: 8
ERSPAN Header Type supported: II and III