About ERSPAN
ERSPAN transports mirrored traffic over an IP network, which provides remote monitoring of multiple switches across your network. The traffic is encapsulated at the source router and is transferred across the network. The packet is decapsulated at the destination router and then sent to the destination interface.
ERSPAN Types
Cisco Nexus 9300 Series switches support ERSPAN Type II, and Cisco Nexus 9500 Series switches support only ERSPAN.
ERSPAN Sources
The interfaces from which traffic can be monitored are called ERSPAN sources. Sources designate the traffic to monitor and whether to copy ingress, egress, or both directions of traffic. ERSPAN sources include the following:
-
Ethernet ports (but not subinterfaces)
-
Forward drops
Note |
A single ERSPAN session can include mixed sources in any combination of the above. |
ERSPAN Sessions
You can create ERSPAN sessions that designate sources to monitor.
Localized ERSPAN Sessions
An ERSPAN session is localized when all of the source interfaces are on the same line card.
High Availability
The ERSPAN feature supports stateless and stateful restarts. After a reboot or supervisor switchover, the running configuration is applied.
For more information on high availability, see the Cisco Nexus 9000 Series NX-OS High Availability and Redundancy Guide.