PDF

Using SPAN

Updated: April 15, 2026

Want to summarize with AI?

Log in

Describes how to configure and use Switched Port Analyzer (SPAN) to mirror network traffic from source ports to destination ports for monitoring and troubleshooting purposes.

SPAN

SPAN is a network utility that

  • copies traffic from one or more ports, VLANs, or endpoint groups (EPGs) and sends the copied traffic to one or more destinations for analysis by a network analyzer

  • operates as a nondisruptive process facilitated in the hardware, which prevents any unnecessary CPU load, and

  • enables detailed troubleshooting or taking a sample of traffic from a particular application host for proactive monitoring and analysis.

SPAN configuration and monitoring capabilities

You can configure SPAN sessions to monitor traffic received by the source (ingress traffic), traffic transmitted from the source (egress traffic), or both. By default, SPAN monitors all traffic, but you can configure filters to monitor only selected traffic.

You can configure SPAN on a tenant or on a switch. When configured on a switch, you can configure SPAN as a fabric policy or an access policy.

APIC supports the encapsulated remote extension of SPAN (ERSPAN).

Beginning with Release 4.1(1i), the following features are now supported:

  • Support for local SPAN with static port-channels as the destination, as long as the sources and the port-channel are local on the same switch.

    Note

    If you are running APIC release 4.1(1i) or later and you configure a static port-channel as the destination, but then downgrade to a release prior to 4.1(1i), then the SPAN session will go into the administrator disabled state because this feature was not available prior to release 4.1.(1i). There is no other functionality impact.

  • You no longer have to include the IP prefix of the Layer 3 interface when configuring source SPAN with Layer 3 interface filtering.

  • Support for configuring filter groups, which is a grouping of one or more filter entries. Use the filter group to specify the matching criteria that will be used to determine if a received packet should be analyzed using SPAN.

  • The SPAN-on-drop feature, which captures packets that are dropped due to forwarding at the ingress in the ASIC and sends them to a pre-configured SPAN destination. There are 3 types of SPAN-on-drop configuration: access drop using access ports as a SPAN source, fabric drop using fabric ports as a SPAN source, and global drop using all ports on a node as a SPAN source. SPAN-on-drop is configured using regular SPAN (through the CLI, GUI, and REST API) and using troubleshooting SPAN (CLI and REST API, only). For more information about configuring this feature, see Configuring SPAN Using the GUI, Configuring SPAN Using the NX-OS Style CLI, and Configuring SPAN Using the REST API.

SPAN configuration types

SPAN configuration types are network monitoring categories that Cisco ACI uses to capture packets from different sources within the network infrastructure.

  • Fabric SPAN captures packets from interfaces between Leaf and Spine switches using only ERSPAN

  • Access SPAN captures packets from interfaces between Leaf switches and external devices using both Local SPAN and ERSPAN, and

  • Tenant SPAN captures packets from VLANs of an EndPoint Group (EPG) on ACI Leaf switches using only ERSPAN.

SPAN session scale mode

A SPAN session scale mode is a session mode that

  • theoretically supports any number of source interfaces per switch

  • provides no filter option support as a tradeoff for increased scale, and

  • was introduced in the 6.1(4) release as part of access SPAN session modes.

Scale mode characteristics

The available SPAN session mode options are Scale and Filter. The scale mode differs from the filter mode, which supports a maximum of 63 source interfaces per switch. Earlier releases did not have session modes; however, the switch behavior was the same as the filter session mode. For more information about the scale session mode, see SPAN Guidelines and Restrictions.

See the Verified Scalability Guide for the qualified number of source interfaces in the scale session mode.

CPU as a destination port for a SPAN session

A CPU as a destination port for a SPAN session is a troubleshooting feature that

  • routes SPAN packets to the CPU port of the leaf switch for packet analysis

  • redirects SPAN to CPU packets to a file for debugging the packets further, and

  • is hardware rate-limited to 1 Mbps.

CPU destination port configuration and access

To access the file with CPU packets, run the tcpdump -xxi tahoe0file_name command. You can specify the file location. For example, /bootflash/file_name.

To get the decoded packets, use: tcpdump -xxi tahoe0 | python3 /isan/utils/span_to_cpu_parser.py --decoder tahoe --verbose --payload

This feature has limitations:

  • SPAN to CPU is supported only for ACL-based SPAN, not for port-based SPAN. This means, SPAN to CPU is not supported in scale mode, only supported in filter mode.

  • Cisco Nexus 9000 FX2 switches and later support the SPAN-to-CPU feature

    • A fault is raised if this feature is configured on unsupported switches. Check the Faults tab under System > Faults on the APIC GUI.

  • Fabric ports and VPC ports on the leaf are not supported as source interface of SPAN to CPU session. For VPC ports, use the path type VPC component PC as the source per switch instead of Virtual Port Channel.

  • Only access port and access port-channels are supported; access port can be a layer 2 or layer 3 port.

  • TX multicast is not supported.

  • In case of source sharing between SPAN to CPU session and other session(s), the policer is applied on both the sessions. Hence, it is not recommended to share sources of SPAN-to-CPU session with other sessions.

SPAN Guidelines and Restrictions

Provides a comprehensive list of SPAN guidelines and restrictions, including supported features, session limitations, filter usage, and destination requirements for Cisco switches and APIC releases.

  • Beginning with the 5.2(3) release, ERSPAN supports IPv6 destinations.

  • The 6.0(3) release supports the Cisco N9K-C9808 switch, which has the following SPAN limitations:

    • Egress (transit (Tx)) SPAN is not supported.

    • SPAN on drop is not supported.

    • You cannot have the same SPAN sources in multiple sessions.

    • SPAN supports an MTU of up to 343 bytes.

  • The 6.1(4) and later releases support the SPAN session in the scale mode, which has the following limitations:

    • Cisco Nexus 9000 FX2 switches and later support a SPAN session in the scale mode.

    • To change the Session mode, the SPAN Source Group must be disabled.

    • Only leaf switches using the Access SPAN type support a SPAN session in the scale mode.

    • Scale session mode does not support any filters such as SPAN Filter Group, SPAN on Drop, L3Out or EPG VLAN.

    • Scale session mode cannot capture Tx (egress) multicast traffic.

  • The 6.1(4) and later releases support the SPAN session in the scale mode, which has the following guidelines:

    • SPAN Source Groups with different Session modes can coexist on the same switch.

    • Any type of source interfaces support a SPAN session in the scale mode.

    • When you upgrade to the 6.1(4) release or later, the session mode in the existing Access SPAN source groups will be set to Filter.

  • Beginning with the 6.2(2) release, Cisco APIC supports ERSPAN Type III (Version 3) for Fabric, Access, and Tenant SPAN. This feature has Enhanced Mixed Version node scope . For more information, see Operations Allowed During Mixed Versions on Cisco ACI Switches in the Cisco APIC Installation and ACI Upgrade and Downgrade Guide .

    For more information about ERSPAN Type III, see https://datatracker.ietf.org/doc/html/draft-foschiano-erspan-03#section-4.3 . These restriction apply for ERSPAN Tpye III (Version 3):

    • Support only the IEEE 1588 timestamp format with the Gra field (timestamp granularity) '10b' (0x3) and platform specific sub-header with platform ID 0x7 where the nanoseconds portion is stored in the timestamp filed of the main ERSPAN Type III header and the seconds portion is stored in the sub-header. These values (Gra and platform ID) are fixed and not configurable.

    • For accurate timestamps, NTP and PTP (for Global and Fabric interfaces) have to be configured on the device where ERSPAN Type III is configured. If PTP is disabled, the timestamps will drift over time and will no longer be accurate.

    • In the platform sub-header, the Source-Index is a concatenation of Group-Index (upper 12 bits) and Port-Index (lower 8 bits). The Group-Index part is not supported.

  • A uSeg EPG or ESG cannot be used as a SPAN source EPG because the SPAN source filter is based on the VLAN ID. Thus, even if an endpoint is classified to a uSeg EPG or an ESG, traffic from the endpoint is mirrored if its VLAN is the VLAN of the SPAN source EPG.

  • When configuring ERSPAN session, if the SPAN source contains a destination and interfaces from a spine switch within a GOLF VRF instance, an L3Out prefix is sent to the GOLF router with the wrong BGP next-hop, breaking connectivity from GOLF to that L3Out.

  • You cannot specify an l3extLIfP Layer 3 subinterface as a SPAN source. You must use the entire port for monitoring traffic from external sources.

  • In local SPAN for FEX interfaces, the FEX interfaces can only be used as SPAN sources, not SPAN destinations.

    • Tx SPAN is not supported.

    • There are no limitations for Rx SPAN.

  • For SPAN of FEX fabric port-channel (NIF), the member interfaces are supported as SPAN source interfaces beginning with APIC release 4.1.

  • For information regarding ERSPAN headers, refer to the IETF Internet Draft at this URL: https://tools.ietf.org/html/draft-foschiano-erspan-00 .

  • ERSPAN destination IP addresses must be learned in the fabric as an endpoint.

    Starting in APIC Release 6.1(2), the ERSPAN destination IP address can also be the one learned and reachable from an L3Out (ERSPAN over L3Out).

  • SPAN supports IPv6 traffic.

  • The individual port member of a port channel or a vPC cannot be configured as the source. Use the port channel, vPC, or vPC component as the source in the SPAN session.

  • A fault is not raised on the ERSPAN source group when the destination EPG is deleted or unavailable.

  • An access SPAN source supports only one of the following filters at a given time:

    • EPG

    • Routed outside (L3Out)

  • When deploying the access SPAN source with an L3Out filter, ensure that the L3Out is also deployed on the matching interface:

    • If an L3Out is deployed on a port, a SPAN source must be deployed on the same port.

    • If an L3Out is deployed on a PC, a SPAN source must be deployed on the same PC.

    • If an L3Out is deployed on a vPC, a SPAN source must be deployed on the same vPC.

  • An L3Out routed interface and routed sub-interface can be deployed on a port or a PC, but an L3Out SVI can be deployed on a port, PC, or vPC. A SPAN source with an L3Out filter must be deployed accordingly.

  • An L3Out filter is not supported in fabric SPAN or tenant SPAN sessions.

  • When an EPG filter is enabled within a SPAN session, ARP packets, which are sent out of the interface in the transit, or tx, direction, will not be spanned.

  • SPAN filter groups are only supported by access SPAN; not supported by fabric SPAN or tenant SPAN.

  • L4 port range filter entries will not be added if you attempt to add more L4 port ranges than are officially supported.

  • A SPAN session will not come up if you attempt to associate more than the supported filter entries at the SPAN source group level or at the individual SPAN source level.

  • Deleted filter entries will remain in TCAM if you add or delete more filters entries than are officially supported.

  • See the Verified Scalability Guide for Cisco ACI document for SPAN-related limits, such as the maximum number of active SPAN sessions and SPAN filter limitations.

  • For the SPAN-on-drop feature, the following guidelines and restrictions apply:

    • The SPAN-on-drop feature is supported on generation 2 leaf switches.

    • The SPAN-on-drop feature only captures packets with forwarding drops in the LUX block, which captures forwarding drop packets at the ingress. The SPAN-on-drop feature cannot capture the BMX (buffer) and RWX (egress) drops.

    • When using the troubleshooting CLI to create a SPAN session with SPAN-on-drop enabled and Cisco APIC as the destination, the session is disabled when 100 MB of data is captured.

    • On a modular chassis, the SPAN-on-drop feature will only work for the packets dropped on the line cards. Packets that are dropped on the fabric card will not be spanned.

    • SPAN-on-drop ACLs with other SPAN ACLs are not merged. If a SPAN-on-drop session is configured on an interface along with ACL-based SPAN, then any packets dropped on that interface will only be sent to the SPAN-on-drop session.

    • You cannot configure SPAN on drop and SPAN ACL on the same session.

    • When an access or fabric port-drop session and a global-drop session are configured, the access or fabric port-drop session takes the priority over the global-drop session.

    • The number of filter entries supported in TCAM = (M * S1 * 1 + N * S2 * 2) + (S3 * 2). This is applicable to rx SPAN or tx SPAN, separately. Currently, the maximum filter entries supported in tx or rx SPAN is 480 in each direction when following this formula (and assuming there are no other sources that are configured without filter-group association [means S3 = 0] and with 16 port-ranges included). When the number of filter entries exceed the maximum number allowed, a fault will be raised. Note that you can specify Layer 4 port ranges in the filter entry. However, sixteen Layer 4 ports are programmed into the hardware as a single filter entry.

      Note

      • M=The number of IPv4 filters

      • S1=The number of sources with IPv4 filters

      • N=The number of IPv6 filters

      • S2=The number of sources with IPv6 filters

      • S3=The number of sources with no filter group association

  • With MAC pinning configured in the LACP policy for a PC or vPC, the PC member ports will be placed in the LACP individual port mode and the PC is operationally non-existent. Hence, a SPAN source configuration with such a PC will fail, resulting in the generation of the "No operational src/dst" fault. With the MAC pinning mode configured, SPAN can be configured only on individual ports.

  • When you use a routed outside SPAN source filter, you see only unicast in the Tx direction. In the Rx direction, you can see unicast, broadcast, and multicast.

  • An L3Out filter is not supported for transmit multicast SPAN. An L3Out is represented as a combination of sclass/dclass in the ingress ACL filters and can therefore match unicast traffic only. Transmit multicast traffic can be spanned only on ports and port-channels.

  • You can use a port channel interface as a SPAN destination only on -EX and later switches.

  • You cannot configure multiple SPAN sessions with the same source interface when a SPAN filter (5-tuple filter) is applied.

  • The local SPAN destination port of a leaf switch does not expect incoming traffic. You can ensure that the switch drops incoming SPAN destination port traffic by configuring a Layer 2 interface policy and setting the VLAN Scope property to Port Local scope instead of Global scope . Apply this policy to the SPAN destination ports. You can configure an Layer 2 interface policy by going to the following location in the GUI: Fabric > Access Policies > Policies > Interface > L2 Interface .

  • When you configure SPAN for a given packet, SPAN is supported for the packet only once. If traffic is selected by SPAN in Rx for the first SSN, the traffic will not selected by SPAN again in Tx for a second SSN. Thus, when the SPAN session ingress and egress port sits on a single switch, the SPAN session capture will be one-way only. The SPAN session cannot display two-way traffic.

  • A SPAN ACL filter configured in the filter group does not filter the broadcast, unknown-unicast and multicast (BUM) traffic that egresses the access interface. A SPAN ACL in the egress direction works only for unicast IPv4 or IPv6 traffic.

  • When configuring a SPAN destination as a local port, EPGs cannot be deployed to that interface.

  • In a leaf switch, a SPAN source with a VRF filter will match all regular bridge domains and all Layer 3 SVIs under the VRF instance. In a spine switch, a SPAN source with a VRF matches only the configured VRF VNID traffic and a bridge domain filter will match only the bridge domain VNID traffic.

  • When you create your own SPAN extended filter entries, you cannot use __UI__AUTO__CONFIG__DEFAULT__EXTENDED__MO as an object name to identify your extended filter entry managed object.

  • Use SPAN destination interfaces that have the same speed. Traffic monitored by a SPAN session may face traffic loss due to SPAN buffer drops even though the destination port is not oversubscribed, but one of the other SPAN destination ports is oversubscribed. The SPAN traffic rate is limited to the slowest SPAN destination interface speed when the destination interfaces have with different speeds and when one of them is oversubscribed.

  • Use a SPAN destination interface speed that is higher than any configured source interfaces and choose a speed that contains enough leeway for micro-bursts. Cloud Scale ASICs do not provide a micro-burst monitoring option for the SPAN class.

  • For the SPAN Destination Group feature, the following guidelines and restrictions apply:

    • ERSPAN over L3Out: When the destination is behind an Infra L3Out, it is not supported.

    • ERSPAN over L3Out: When the span source is a fabric port on a spine node, it is not supported.

    • ERSPAN over infra SR-MPLS L3out is not supported.

    • ERSPAN over L3out on remote leaf is not supported when destination is reachable through the user tenant L3out on remote leaf Uplink fabric port.

Configure a tenant SPAN session using the Cisco APIC GUI

SPAN can be configured on a switch or on a tenant. This section guides you through the Cisco APIC GUI to configure a SPAN policy on a tenant to forward replicated source packets to a remote traffic analyzer. The configuration procedure requires entering values in the fields of one or more GUI dialog boxes. To understand a field and determine a valid value, view the help file by clicking the help icon (?) at the top-right corner of the dialog box.

Follow these steps to configure a tenant SPAN session using the Cisco APIC GUI:

Procedure

  1. In the menu bar, click Tenants.

  2. In the submenu bar, click the tenant that contains the source endpoint.

  3. In the Navigation pane, expand the tenant, expand Policies > Troubleshooting > SPAN.

    Two nodes appear under SPAN: SPAN Destination Groups and SPAN Source Groups.

  4. From the Navigation pane, right-click SPAN Source Groups and choose Create SPAN Source Group.

    The Create SPAN Source Group dialog appears.

  5. Enter the appropriate values in the required fields of the Create SPAN Source Group dialog box.

  6. Expand the Create Sources table to open the Create SPAN Source dialog box.

  7. Enter the appropriate values in the Create SPAN Source dialog box fields.

  8. When finished creating the SPAN source, click OK.

    You return to the Create SPAN Source Group dialog box.

  9. When finished entering values in the Create SPAN Source Group dialog box fields, click Submit.

What to do next

Using a traffic analyzer at the SPAN destination, you can observe the data packets from the SPAN source EPG to verify the packet format, addresses, protocols, and other information.

Configure a SPAN filter group using the APIC GUI

Configure a SPAN filter group to define specific filtering criteria for monitoring network traffic. This allows you to capture and analyze only the traffic that matches your specified parameters such as source and destination IP addresses, ports, protocols, and other packet characteristics.

SPAN filter groups are used in network troubleshooting to selectively capture traffic based on defined criteria. Use this configuration when you need to monitor specific traffic flows without capturing all network traffic, which helps reduce the volume of data for analysis.

Procedure

  1. In the menu bar, click on Fabric and in the submenu bar click on Access Policies.

  2. In the Navigation pane, expand Policies > Troubleshooting, and expand SPAN.

  3. Under SPAN, right-click SPAN Filter Groups and choose Create SPAN Filter Group.

    The Create Filter Group dialog appears.

  4. Enter a name for the SPAN filter group. In the Filter Entries table, click + and enter values for the following fields:

    • Source IP Prefix: Enter a source IP address in the form of IP-address/mask. Both IPv4 and IPv6 addresses are supported. Use a value of 0.0.0.0 to denote an IPv4 address any entry in this field or use a value of :: to denote an IPv6 address any entry in this field.

    • First Source Port: Enter the first source Layer 4 port. This field, together with the Last Source Port field, specifies a port range for filtering source ports. Use a value of 0 to denote an any entry in this field.

    • Last Source Port: Enter the last source Layer 4 port. This field, together with the First Source Port field, specifies a port range for filtering source ports. Use a value of 0 to denote an any entry in this field.

    • Destination IP Prefix: Enter a destination IP address in the form of IP-address/mask. Both IPv4 and IPv6 addresses are supported. Use a value of 0.0.0.0 to denote an IPv4 address any entry in this field or use a value of :: to denote an IPv6 address any entry in this field.

    • First Destination Port: Enter the first destination Layer 4 port. This field, together with the Last Destination Port field, specifies a port range for filtering destination ports. Use a value of 0 to denote an any entry in this field.

    • Last Destination Port: Enter the last destination Layer 4 port. This field, together with the First Destination Port field, specifies a port range for filtering destination ports. Use a value of 0 to denote an any entry in this field.

    • IP Protocol: Enter the IP protocol. Use a value of 0 to denote an any entry in this field.

    • In the Extended Filter Entries table, click + and enter values for the following fields:

      • Name: Enter a name for the extended filter entry.

      • DSCP From: Enter the DSCP value. This field, together with the DSCP To field, specifies the range for filtering DSCP values.

      • DSCP To: Enter the DSCP value. This field, together with the DSCP From field, specifies the range for filtering DSCP values.

      • Dot1P From: Enter the Dot1P value. This field, together with the Dot1P To field, specifies the range for filtering Dot1P values.

      • Dot1P To: Enter the Dot1P value. This field, together with the Dot1P From field, specifies the range for filtering Dot1P values.

        You can either specify the values for the source port and the destination port range or the DSCP and Dot1P range. If you specify both the source port and the destination port range and the DSCP and Dot1P range, faults are displayed.

        DSCP or Dot1P is not supported for the egress direction. If you choose Both as the direction, then either DSCP or Dot1P is supported for ingress direction only and not for egress direction.

      • TCP Flags: Choose a protocol from the TCP Flags drop-down list.

        You can configure TCP Flags only if you chose Unspecified or TCP as the IP Protocol in the drop-down list for the filter group.

      • Packet Type: Choose the packet type. You can either choose Routed/Switched, Routed, or Switched Only.

  5. Click Update, then click Submit when you have entered the appropriate values into each of the fields in this form.

The SPAN filter group is created with the specified filtering criteria and is available for use in SPAN sessions to selectively capture network traffic that matches the defined parameters.

Configure an access SPAN policy using the APIC GUI

This task enables you to set up network monitoring by creating a SPAN policy that copies packets from specified source interfaces to destination analyzers for traffic analysis and troubleshooting.

Releases prior to 6.1(4) did not have session modes; however, the switch behavior was the same as the filter session mode.

Follow these steps to configure an access SPAN policy using the APIC GUI.

Procedure

  1. In the menu bar, click on Fabric > Access Policies.

  2. In the Navigation pane, expand Policies > Troubleshooting > SPAN.

    Three nodes appear under SPAN: SPAN Source Groups, SPAN Filter Groups, and SPAN Destination Groups.

  3. Right-click SPAN Source Groups and choose Create SPAN Source Group.

    The Create SPAN Source Group dialog appears.

  4. For Admin State, choose Disabled or Enabled.

  5. In the 6.1(4) release and later, for Session mode, choose Filter or Scale.

  6. In the Filter Group field, select or create a filter group.

    In the 6.1(4) release and later, this option is not supported and not visible when the Session Mode is set to Scale.

    See Configure a SPAN filter group using the APIC GUI for more information.

  7. In the Destination Group field, select or create a SPAN destination group.

    See Configure a destination group for an access SPAN policy using the Cisco APIC GUI for more information.

  8. Expand the Create Sources table to open the Create SPAN Source dialog box and perform these actions:

    1. Enter a Name for the source policy.
    2. Choose a Direction option for the traffic flow.

    When the Session Mode is set to Filter, which is the only mode prior to 6.1(4), these three fields related to SPAN filters are available:

    1. Optional: In the Filter Group field, select or create a filter group.
    2. Click to place a check mark in the SPAN Drop Packets check box. When checked, the SPAN-on-drop feature is enabled.
    3. In the Type field, select None, EPG or Routed Outside.

      When you choose EPG or Routed Outside, the SPAN session includes the corresponding VLAN filters.

      When you choose EPG , then the Source EPG field appears for you to choose the Tenant, Application Profile and EPG to be used as the filter.

      When Routed Outside is selected, the Routed Outside Name field appears for you to select the L3out and the Encapfield appears for you to select the VLAN.

    The remaining substeps apply to any mode:

    1. Expand Add Source Access Paths to specify the source path.

      The Associate Source to Path dialog box appears.

    2. Enter the appropriate values in the Associate Source to Path dialog box fields.
    3. When you are finished associating the source to a path, click OK.

      You return to the Create SPAN Source dialog box.

    4. When you are finished configuring the SPAN source, click OK.

      You return to the Create SPAN Source Group dialog box.

    1. Enter a Name for the source policy.
    2. Choose a Direction option for the traffic flow.
    3. Optional: In the Filter Group field, select or create a filter group.
    4. Click to place a check mark in the SPAN Drop Packets check box. When checked, the SPAN-on-drop feature is enabled.
    5. In the Type field, select None, EPG or Routed Outside.

      When you choose EPG or Routed Outside, the SPAN session includes the corresponding VLAN filters.

      When you choose EPG , then the Source EPG field appears for you to choose the Tenant, Application Profile and EPG to be used as the filter.

      When Routed Outside is selected, the Routed Outside Name field appears for you to select the L3out and the Encapfield appears for you to select the VLAN.

    6. Expand Add Source Access Paths to specify the source path.

      The Associate Source to Path dialog box appears.

    7. Enter the appropriate values in the Associate Source to Path dialog box fields.
    8. When you are finished associating the source to a path, click OK.

      You return to the Create SPAN Source dialog box.

    9. When you are finished configuring the SPAN source, click OK.

      You return to the Create SPAN Source Group dialog box.

  9. When you are finished configuring the SPAN source group, click Submit.

The access SPAN policy is configured and active. Traffic from the specified source interfaces is now being mirrored to the destination group for analysis.

What to do next

Using a traffic analyzer at the SPAN destination, you can observe the data packets from the SPAN source to verify the packet format, addresses, protocols, and other information.

Configure a fabric SPAN policy using the Cisco APIC GUI

Configure a fabric SPAN policy to enable network traffic monitoring and analysis through packet mirroring capabilities.

This section guides you through the Cisco APIC GUI to create a fabric SPAN policy. The configuration procedure requires entering values in the fields of one or more GUI dialog boxes.

Procedure

  1. In the menu bar, click on Fabric > Fabric Policies.

  2. In the Navigation pane, expand Policies > Troubleshooting > SPAN.

    Three nodes appear under SPAN: SPAN Source Groups, SPAN Filter Groups, and SPAN Destination Groups.

  3. Right-click SPAN Source Groups and choose Create SPAN Source Group.

    The Create SPAN Source Group dialog appears.

  4. Enter the appropriate values in the Create SPAN Source Group dialog box fields.

  5. Expand the Create Sources table to open the Create SPAN Source dialog box.

  6. Enter the appropriate values in the Create SPAN Source dialog box fields.

  7. When finished, click OK.

    You return to the Create SPAN Source Group dialog box.

  8. When finished entering values in the Create SPAN Source Group dialog box fields, click Submit.

The fabric SPAN policy is created and can be used for network traffic monitoring and analysis.

What to do next

Using a traffic analyzer at the SPAN destination, you can observe the data packets from the SPAN source to verify the packet format, addresses, protocols, and other information.

Configure a destination group for a tenant SPAN policy using the Cisco APIC GUI

Creating a SPAN destination group and source enables you to use a traffic analyzer at the SPAN destination to observe the data packets from the SPAN source and verify the packet format, addresses, protocols, and other information.

This section guides you through the Cisco APIC GUI to create a destination group for a Tenant SPAN policy. The configuration procedure requires entering values in the fields of one or more GUI dialog boxes.

Before you begin

Follow these steps to configure a destination group for a tenant SPAN policy using the Cisco APIC GUI:

Procedure

  1. In the menu bar, click Tenants.

  2. In the submenu bar, click the tenant that contains the source endpoint.

  3. In the Navigation pane, expand the tenant, expand Policies > Troubleshooting > SPAN.

    Two nodes appear under SPAN: SPAN Destination Groups and SPAN Source Groups.

  4. Right-click SPAN Destination Groups and choose Create SPAN Destination Group.

    The Create SPAN Destination Group dialog appears.

    1. In the Name field, enter a name for the SPAN destination group.
    2. Optional. In the Description field, enter a description of the SPAN destination group.
    3. In the Destination Type, select either Application EPG or L3Out EPG.

      When you specify the Application EPG as the Destination Type for the SPAN packets, you must also include the tenant, application profile, and destination EPG.

      When you specify the L3Out EPG as the Destination Type for the SPAN packets, you must also include the tenant, L3Out name, and external EPG network.

    4. Specify the Destination IP of the remote server that will receive the replicated packets.
    5. Specify the Source IP/Prefix, which is the base IP address of the IP subnet of the source packets.
    6. Specify the Flow ID of the SPAN packet. The range is from 1 to 1023. The default is 1.
    7. Specify the TTL or hop limit. The range is from 1 to 255 hops; if set to zero, then no TTL is specified. The default is 64 hops
    8. Specify the MTU value. The range is from 64 to 9216. The default is 1518.
    9. Specify the DSCP level of the SPAN destination.

  5. When finished, click Submit.

    The destination group is created.

The SPAN destination group is created and configured, enabling traffic analysis at the destination to observe data packets from the SPAN source.

Configure a destination group for an access SPAN policy using the Cisco APIC GUI

Creating a SPAN destination group and source enables you to use a traffic analyzer at the SPAN destination to observe the data packets from the SPAN source and verify the packet format, addresses, protocols, and other information.

This section guides you through the Cisco APIC GUI to create a destination group for an access SPAN policy. The configuration procedure requires entering values in the fields of one or more GUI dialog boxes.

Procedure

  1. In the menu bar, click on Fabric > Access Policies.

  2. In the Navigation pane, expand Policies > Troubleshooting > SPAN.

    Three nodes appear under SPAN: SPAN Source Groups, SPAN Filter Groups, and SPAN Destination Groups.

  3. Right-click SPAN Destination Groups and choose Create SPAN Destination Group.

    1. In the Name field, enter a name for the SPAN destination group.
    2. Optional. In the Description field, enter a description of the SPAN destination group.
    3. In the Destination Type, select either Application EPG or L3Out EPG, or Access Interface.

      Application EPG and and L3Out EPG are configured as ERSPAN, while Access Interface is configured as Local SPAN.

      When you specify the Application EPG as the Destination Type for the SPAN packets, you must also include the tenant, application profile, and destination EPG.

      When you specify the L3Out EPG as the Destination Type for the SPAN packets, you must also include the tenant, L3Out profile, and external network.

    4. Specify the Destination IP of the remote server that will receive the replicated packets.
    5. Specify the Source IP/Prefix, which is the base IP address of the IP subnet of the source packets.
    6. Specify the Flow ID of the SPAN packet. The range is from 1 to 1023. The default is 1.
    7. Specify the TTL or hop limit. The range is from 1 to 255 hops; if set to zero, then no TTL is specified. The default is 64 hops
    8. Specify the MTU value. The range is from 64 to 9216. The default is 1518.
    9. Specify the DSCP level of the SPAN destination.

  4. When finished, click Submit.

    The destination group is created.

You have successfully configured a destination group for an access SPAN policy. The destination group is now available for use in SPAN configurations to replicate and analyze network traffic.

Configure a destination group for a fabric SPAN policy using the Cisco APIC GUI

Creating a SPAN destination group and source enables you to use a traffic analyzer at the SPAN destination to observe the data packets from the SPAN source and verify the packet format, addresses, protocols, and other information.

This section guides you through the Cisco APIC GUI to create a destination group for a fabric SPAN policy. The configuration procedure requires entering values in the fields of one or more GUI dialog boxes.

Note

If you configure the SPAN source as the spine port and select L3Out as the destination, then a fault is raised on the corresponding spine node that informs you about the invalid configuration.

Before you begin

You must configure NTP and PTP on the devices where you have enabled ERSPAN Version 3.

Follow these steps to configure a destination group for a fabric SPAN policy using the Cisco APIC GUI:

Procedure

  1. In the menu bar, click on Fabric > Fabric Policies.

  2. In the Navigation pane, expand Policies > Troubleshooting > SPAN.

    Three nodes appear under SPAN: SPAN Source Groups, SPAN Filter Groups, and SPAN Destination Groups.

  3. Right-click SPAN Destination Groups and choose Create SPAN Destination Group.

    1. In the Name field, enter a name for the SPAN destination group.
    2. Optional. In the Description field, enter a description of the SPAN destination group.
    3. In the Destination Type, select either Application EPG, L3Out EPG.

      When you specify the Application EPG as the Destination Type for the SPAN packets, you must also include the tenant, application profile, and destination EPG.

      When you specify the L3Out EPG as the Destination Type for the SPAN packets, you must also include the tenant, L3Out profile, and external network.

    4. In the SPAN Version field, select either Version 2 or Version 3.
    5. Specify the Destination IP of the remote server that will receive the replicated packets.
    6. Specify the Source IP/Prefix, which is the base IP address of the IP subnet of the source packets.
    7. Specify the Flow ID of the SPAN packet. The range is from 1 to 1023. The default is 1.
    8. Specify the TTL or hop limit. The range is from 1 to 255 hops; if set to zero, then no TTL is specified. The default is 64 hops
    9. Specify the MTU value. The range is from 64 to 9216. The default is 1518.
    10. Specify the DSCP level of the SPAN destination.

  4. When finished, click Submit.

    The destination group is created.

You have successfully configured a destination group for a fabric SPAN policy. The destination group is now available for use with SPAN sources to enable traffic monitoring and analysis.

What to do next

If not already created, configure a source for the fabric SPAN policy.

Configure a fabric destination group for an ERSPAN destination using the REST API

This task configures a fabric destination group for an ERSPAN destination to enable network traffic monitoring and analysis.

This section demonstrates how to use the REST API to configure a fabric destination group for an ERSPAN destination using the REST API. For a complete list of properties, see the APIC Management Information Model Reference.

Procedure

Configure a fabric destination group for an ERSPAN destination: 

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanDestGrp annotation="" descr="" name="Dest2" nameAlias="" ownerKey="" ownerTag="">
    <spanDest annotation="" descr="" name="Dest2" nameAlias="" ownerKey="" ownerTag="">
    <spanRsDestEpg annotation="" dscp="unspecified" finalIp="0.0.0.0" flowId="1" ip="179.10.10.179" 
     mtu="1518"srcIpPrefix="20.20.20.2" tDn="uni/tn-ERSPAN/ap-A1/epg-E1" ttl="64" ver="ver2" 
     verEnforced="no"/>
    </spanDest>
</spanDestGrp>

The fabric destination group for the ERSPAN destination is configured and ready to monitor network traffic.

Configure a global drop source group using the REST API

This task configures a global drop source group to monitor dropped packets on specific network nodes using the REST API.

This section demonstrates how to use the REST API to configure a global drop source group using the REST API. For a complete list of properties, see the APIC Management Information Model Reference.

Procedure

Configure a global drop source group: 

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanSrcGrp adminSt="enabled" annotation="" descr="" name="Spine-402-GD-SOD" nameAlias="">
    <spanSrc annotation="" descr="" dir="both" name="402" nameAlias=""  spanOnDrop="yes">
    <spanRsSrcToNode annotation="" tDn="topology/pod-1/node-402"/>
    </spanSrc><spanSpanLbl annotation="" descr="" name="402-dst-179" nameAlias=""  tag="yellow-green"/>
</spanSrcGrp>

The global drop source group is configured and enabled to monitor dropped packets on the specified node.

Configure a leaf port as a SPAN destination using the REST API

This task configures a leaf port as a SPAN (Switched Port Analyzer) destination to enable network traffic monitoring and analysis through the REST API.

This section demonstrates how to use the REST API to configure a leaf port as a SPAN destination using the REST API. For a complete list of properties, see the APIC Management Information Model Reference.

Procedure

Configure a leaf port as a SPAN destination: 

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanDestGrp annotation="" descr="" name="Dest4" nameAlias="" ownerKey="" ownerTag="">
    <spanDest annotation="" descr="" name="Dest4" nameAlias="" ownerKey="" ownerTag="">
    <spanRsDestPathEp annotation="" mtu="1518" tDn="topology/pod-1/paths-301/pathep-[eth1/18]"/>
    </spanDest>
</spanDestGrp>

The leaf port is successfully configured as a SPAN destination and can now receive mirrored network traffic for monitoring purposes.

Configure a SPAN access source group using the REST API

This task enables you to configure a SPAN access source group using the REST API to monitor network traffic and analyze data flows.

This section demonstrates how to use the REST API to configure a SPAN access source group using the REST API. For a complete list of properties, see the APIC Management Information Model Reference.

Procedure

Configure a SPAN access source group: 

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanSrcGrp adminSt="enabled" annotation="" descr=""  name="Test-Src2" nameAlias="" ownerKey="" 
 ownerTag="">
    <spanSrc annotation="" descr="" dir="both" name="Src1" nameAlias="" ownerKey="" ownerTag="" 
     spanOnDrop="yes">
    <spanRsSrcToPathEp annotation="" tDn="topology/pod-1/paths-301/pathep-[eth1/1]"/>
    </spanSrc>
    <spanSpanLbl annotation="" descr="" name="Dest1" nameAlias="" ownerKey="" ownerTag="" 
     tag="yellow-green"/>
</spanSrcGrp>

The SPAN access source group is successfully configured and enabled for monitoring network traffic in both directions.

Configure a SPAN fabric source group using the REST API

This task allows you to configure a SPAN fabric source group through the REST API to monitor network traffic by copying packets from source interfaces to destination monitoring devices.

This section demonstrates how to use the REST API to configure a SPAN fabric source group using the REST API. For a complete list of properties, see the APIC Management Information Model Reference.

Procedure

Configure a SPAN fabric source group: 

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanSrcGrp adminSt="enabled" annotation="" descr="" name="Test-Src2" nameAlias="" ownerKey="" 
 ownerTag="">
    <spanSrc annotation="" descr="" dir="both" name="Src1" nameAlias="" ownerKey="" 
     ownerTag="" spanOnDrop="yes">
    <spanRsSrcToPathEp annotation="" tDn="topology/pod-1/paths-301/pathep-[eth1/51]"/>
    </spanSrc>
    <spanSpanLbl annotation="" descr="" name="Dest2" nameAlias="" ownerKey="" ownerTag="" 
     tag="yellow-green"/>
</spanSrcGrp>

The SPAN fabric source group is configured with the specified source interface and destination label settings.

Configure an access destination group for an ERSPAN destination using the REST API

This task allows you to set up an access destination group for ERSPAN destination configuration through the REST API interface.

This section demonstrates how to use the REST API to configure an access destination group for an ERSPAN destination using the REST API. For a complete list of properties, see the APIC Management Information Model Reference.

Procedure

Configure an access destination group for an ERSPAN destination. 

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanDestGrp annotation="" descr="" name="Dest4" nameAlias="" ownerKey="" 
  ownerTag="">
    <spanDest annotation="" descr="" name="Dest4" nameAlias="" ownerKey="" 
     ownerTag="">
    <spanRsDestPathEp annotation="" mtu="1518" tDn="topology/pod-1/paths-301/pathep-
     [eth1/18]"/>
    </spanDest>
</spanDestGrp>

The access destination group for the ERSPAN destination is successfully configured through the REST API.

Configure a SPAN filter with extended filters using the REST API

Configure a SPAN Filter using the REST API to enable network traffic monitoring with specific filter criteria and extended filter parameters.

Use this procedure when you need to configure SPAN filtering with extended filter capabilities through the REST API interface.

Procedure

Configure a SPAN Filter using the REST API.

Example:

URL: {{apic-host}}/api/node/mo/.xml
BODY:
<polUni>
   <infraInfra dn="uni/infra">
      <spanSrcGrp adminSt="enabled" descr="" dn="uni/infra/srcgrp-local1" nameAlias="" ownerKey="" 
       ownerTag="">
          <spanRsSrcGrpToFilterGrp tDn="uni/infra/filtergrp-two" />
          <spanSrc descr="" dir="both" name="src1" nameAlias="" ownerKey="" ownerTag="">
          <spanRsSrcToPathEp tDn="topology/pod-1/paths-101/pathep-[eth1/15]" />
          </spanSrc>
          <spanSpanLbl descr="" name="dest1" nameAlias="" ownerKey="" ownerTag="" tag=
           "yellow-green" />
       </spanSrcGrp>
       <spanDestGrp annotation="" descr="" dn="uni/infra/destgrp-dest1" nameAlias="" ownerKey="" 
        ownerTag="">
          <spanDest annotation="" descr="" name="destg" nameAlias="" ownerKey="" ownerTag="">
          <spanRsDestPathEp annotation="" mtu="1518" tDn="topology/pod-1/paths-101/pathep-
           [eth1/7]" />
           </spanDest>
       </spanDestGrp>
       <spanFilterGrp name="two">
          <spanFilterEntry name="udp_two" ipProto="udp" srcAddr="1002::1/64" dstAddr="1001::1/64" 
           srcPortFrom="1" srcPortTo="2" dstPortFrom="1" dstPortTo="2">
              <spanExtendedFltEntry name="arun1" dscpFrom="0" dscpTo="10" dot1pFrom="0" dot1pTo="7" 
               tcpFlags="128" v6FlowLabel="1522" forwardingVal="switched" />
           </spanFilterEntry>
       </spanFilterGrp>
    </infraInfra>
</polUni>

The SPAN Filter with extended filters is configured and ready to monitor network traffic according to the specified filter criteria.