The Cisco DNA Traffic Telemetry Appliance supports the Encapsulated Remote Switching Port Analyzer (ERSPAN) feature on both source and destination ports. The ERSPAN transports mirrored traffic over an IP network. The traffic is encapsulated at the source router and transferred across the network. The packet is decapsulated at the destination router and then sent to the destination interface. The ERSPAN consists of an ERSPAN source session, routable ERSPAN Generic Routing Encapsulation (GRE) traffic, and an ERSPAN destination session. You can configure the network devices to mirror traffic on specific ports or VLANs and send the traffic to the telemetry sensor for deep packet inspection (DPI). The telemetry sensor receives and processes the data from a port that is configured as ERSPAN. The port's source sessions and destination sessions are on different switches.

The Cisco DNA Traffic Telemetry Appliance supports seven monitoring interfaces and one telemetry interface. The monitoring interfaces receive traffic from a switch or router through ERSPAN mirroring. The Cisco DNA Traffic Telemetry Appliancesends the traffic to Network-Based Application Recognition (NBAR) to analyze and produce the NetFlow telemetry stream for DNA Center.

You can configure the monitoring interface with an IPv4 address. This interface acts as an ERSPAN decapsulation interface and terminates the ERSPAN traffic and removes the ERSPAN header. After removing the IPv4 address, the traffic is sent to the next available monitoring interface or tunnel. This interface acts as an ERSPAN destination interface and analyzes the original traffic through NBAR.

Use the following commands to configure the ERSPAN destination interface:

• ip nbar protocol-discovery

• ip flow monitor

• performance monitor

This section describes the connections to make when using a Cisco DNA Traffic Telemetry Appliance.

Option 1: Organization's Aggregation Switch Has 10GE Port Available

Cisco DNA Traffic Telemetry Appliance Port	Interface	Connection
TE0 or TE1	Te0/0/0 or Te0/0/1	Organization's aggregation switch, 10GE port: Span connection (for traffic analysis and device discovery)
GE5	Gi0/0/5	Management network

Note	10 Gigabit Ethernet (10GE) ports are commonly labeled TE.

Option 2: Organization's Aggregation Switch Has 1GE Ports Only

Cisco DNA Traffic Telemetry Appliance Port	Interface	Connection
Any one of: GE0 to GE4	Gi0/0/0 to Gi0/0/4	Organization's aggregation switch, GE port: Span connection (for traffic analysis and device discovery)
GE5	Gi0/0/5	Management network

Network settings include:

• Cisco DNA Traffic Telemetry Appliance interface

• Default route

1. Connect the network port to reach Cisco DNA Center and configure the IP address on the appliance. Example:

   #show run int gigabitEthernet 0/0/5 
   interface GigabitEthernet0/0/5 
   description ***** Management Interface  ******** 
   ip address 10.33.100.13 255.255.255.0 
   negotiation auto 
   cdp enable 
   end 

2. (Optional) Configure the loopback IP address. Example:

   interface Loopback0 
   ip address 10.33.33.26 255.255.255.255 

3. Configure the credentials and enable the password, SSH, and NETCONF. Example:

   hostname  <hostname>
    username dna privilege 15 algorithm-type scrypt secret  <password>
   enable secret  <password>
             service password-encryption 
   ip domain name dnasolutions.com 
   ip ssh version 2 
              line vty 0 15 
                  login local 
                  transport input ssh 
                  transport preferred none 
      ip ssh source-interface loopback0 
   aaa new-model 
   aaa authentication login default local 
   aaa authorization exec default local 
   netconf-yang 

4. Configure the default route. Example:

   ip route 0.0.0.0 0.0.0.0 10.33.100.1 

5. In a wireless environment, for wireless traffic monitoring, configure NBAR support for CAPWAP:

   conf t 
   ip nbar classification tunneled-traffic capwap