Network Management Configuration Guide, Cisco IOS XE Fuji 16.9.x (Catalyst 9300 Switches)

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Network Management Configuration Guide, Cisco IOS XE Fuji 16.9.x (Catalyst 9300 Switches)

Chapter Title

Configuring ERSPAN

Results

Updated:
March 21, 2022

Chapter: Configuring ERSPAN

Configuring ERSPAN

Configuring ERSPAN

This module describes how to configure the Encapsulated Remote Switched Port Analyzer (ERSPAN). The Cisco ERSPAN feature allows you to monitor traffic on ports or VLANs and send the monitored traffic to destination ports.

Prerequisites for Configuring ERSPAN

  • Access control list (ACL) filter is applied before sending the monitored traffic on to the tunnel.

  • Only supports Type-II ERSPAN header.

Restrictions for Configuring ERSPAN

The following restrictions apply for this feature:

  • Destination sessions are not supported.

  • You can configure either a list of ports or a list of VLANs as a source, but cannot configure both for a given session.

  • When a session is configured through the ERSPAN CLI, the session ID and the session type cannot be changed. To change them, you must use the no form of the commands to remove the session and then reconfigure it.

  • ERSPAN source sessions do not copy locally-sourced RSPAN VLAN traffic from source trunk ports that carry RSPAN VLANs.

  • ERSPAN source sessions do not copy locally-sourced ERSPAN Generic routing encapsulation (GRE)-encapsulated traffic from source ports.

  • Disabling the ip routing command for IPv4 connections and ipv6 unicast-routing command for IPv6 connections stops ERSPAN traffic flow to the destination port.

Information for Configuring ERSPAN

ERSPAN Overview

The Cisco ERSPAN feature allows you to monitor traffic on ports or VLANs, and send the monitored traffic to destination ports. ERSPAN sends traffic to a network analyzer, such as a Switch Probe device or a Remote Monitoring (RMON) probe. ERSPAN supports source ports, source VLANs, and destination ports on different devices, which helps remote monitoring of multiple devices across a network.

ERSPAN supports encapsulated packets of up to 9180 bytes. ERSPAN consists of an ERSPAN source session, routable ERSPAN GRE-encapsulated traffic, and an ERSPAN destination session.

You can configure an ERSPAN source session, an ERSPAN destination session, or both on a device. A device on which only an ERSPAN source session is configured is called an ERSPAN source device, and a device on which only an ERSPAN destination session is configured is called an ERSPAN termination device. A device can act as both; an ERSPAN source device and a termination device. To avoid over-subscription of traffic, which can lead to drop in management traffic on the destination device, ensure that the destination session is configured and is working on the destination device, before configuring a source session on the source device.

For a source port or a source VLAN, the ERSPAN can monitor the ingress, egress, or both ingress and egress traffic. By default, ERSPAN monitors all traffic, including multicast, and Bridge Protocol Data Unit (BPDU) frames.

A device supports up to 66 sessions. A maximum of 8 source sessions can be configured and the remaining sessions can be configured as RSPAN destinations sessions. A source session can be a local SPAN source session or an RSPAN source session or an ERSPAN source session.

An ERSPAN source session is defined by the following parameters:

  • A session ID

  • ERSPAN flow ID

  • List of source ports or source VLANs to be monitored by the session

  • Optional attributes, such as, IP type of service (ToS) and IP Time to Live (TTL), related to the GRE envelope

  • The destination and origin IP addresses, which are used as the destination and source IP addresses of the generic routing encapsulation (GRE) envelope for the captured traffic, respectively


Note

  • ERSPAN source sessions do not copy ERSPAN GRE-encapsulated traffic from source ports. Each ERSPAN source session can have either ports or VLANs as sources, but not both.

  • Only IPv4 delivery/transport header is supported.

Figure 1. ERSPAN Configuration

ERSPAN Sources

The Cisco ERSPAN feature supports the following sources:

  • Source ports—A source port that is monitored for traffic analysis. Source ports in any VLAN can be configured and trunk ports can be configured as source ports along with nontrunk source ports.

  • Source VLANs—A VLAN that is monitored for traffic analysis.

How to Configure ERSPAN

Configuring an ERSPAN Source Session

The ERSPAN source session defines the session configuration parameters and the ports or VLANs to be monitored.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. interface interface-type interface-number
  4. monitor session span-session-number type erspan-source
  5. description string
  6. source {interface interface-type interface-number | vlan vlan-id} [, | - | both | rx | tx]
  7. filter {ip access-group {standard-access-list | expanded-access-list | acl-name } | ipv6 access-group acl-name | mac access-group acl-name | vlan vlan-ID [, | -]}
  8. destination
  9. erspan-id erspan-flow-id
  10. ip address ip-address
  11. ip ttl ttl-value
  12. origin ip-address ip-address
  13. exit
  14. no shutdown
  15. end

DETAILED STEPS

  Command or Action Purpose
Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface interface-type interface-number

Example:

Device(config)# interface GigabitEthernet 1/0/1

Specifies the interface on which ERSPAN source session is configured.

Step 4

monitor session span-session-number type erspan-source

Example:

Device(config)# monitor session 1 type erspan-source

Defines an ERSPAN source session using the session ID and the session type, and enters ERSPAN monitor source session configuration mode.

  • The span-session-number argument range is from 1 to 66. The same session number cannot be used more than once.

  • The session IDs for source sessions or destination sessions are in the same global ID space, so each session ID is globally unique for both session types.

  • The session ID (configured by the span-session-number argument) and the session type (configured by the erspan-source keyword) cannot be changed once entered. Use the no form of this command to remove the session and then re-create the session, with a new session ID or a new session type.

Step 5

description string

Example:

Device(config-mon-erspan-src)# description source1

(Optional) Describes the ERSPAN source session.

  • The string argument can be up to 240 characters and cannot contain special characters or spaces.

Step 6

source {interface interface-type interface-number | vlan vlan-id} [, | - | both | rx | tx]

Example:

Device(config-mon-erspan-src)# source interface fastethernet 0/1 rx

Configures the source interface or the VLAN, and the traffic direction to be monitored.
Step 7

filter {ip access-group {standard-access-list | expanded-access-list | acl-name } | ipv6 access-group acl-name | mac access-group acl-name | vlan vlan-ID [, | -]}

Example:

Switch(config-mon-erspan-src)# filter vlan 3

(Optional) Configures source VLAN filtering when the ERSPAN source is a trunk port.

Note 
You cannot include source VLANs and filter VLANs in the same session.
Step 8

destination

Example:

Device(config-mon-erspan-src)# destination

Enters ERSPAN source session destination configuration mode.

Step 9

erspan-id erspan-flow-id

Example:

Device(config-mon-erspan-src-dst)# erspan-id 100

Configures the ID used by source and destination sessions to identify the ERSPAN traffic, which must also be entered in the ERSPAN destination session configuration.

Step 10

ip address ip-address

Example:

Device(config-mon-erspan-src-dst)# ip address 10.1.0.2

Configures the IP address that is used as the destination of the ERSPAN traffic.

Step 11

ip ttl ttl-value

Example:

Device(config-mon-erspan-src-dst)# ip ttl 32

(Optional) Configures the IP TTL value of packets in the ERSPAN traffic.

Step 12

origin ip-address ip-address

Example:

Device(config-mon-erspan-src-dst)# origin ip address 10.10.0.1

Configures the IP address used as the source of the ERSPAN traffic.

Step 13

exit

Example:

Device(config-mon-erspan-src-dst)# exit

Exits ERSPAN source session destination configuration mode, and returns to ERSPAN source session configuration mode.

Step 14

no shutdown

Example:

Device(config-mon-erspan-src)# no shutdown

Enables the configured sessions on an interface.

Step 15

end

Example:

Device(config-mon-erspan-src)# end

Exits ERSPAN source session configuration mode, and returns to privileged EXEC mode.

Configuration Examples for ERSPAN

Example: Configuring an ERSPAN Source Session

The following example shows how to configure an ERSPAN source session: 

Device> enable
Device# configure terminal
Device(config)# monitor session 1 type erspan-source
Device(config-mon-erspan-src)# description source1
Device(config-mon-erspan-src)# source interface fastethernet 0/1 rx
Device(config-mon-erspan-src)# filter vlan 3
Device(config-mon-erspan-src)# no shutdown
Device(config-mon-erspan-src)# destination
Device(config-mon-erspan-src-dst)# ip address 10.1.0.2
Device(config-mon-erspan-src-dst)# erspan-id 2
Device(config-mon-erspan-src-dst)# origin ip-address 203.0.113.2
Device(config-mon-erspan-src-dst)# ip ttl 32
Device(config-mon-erspan-src-dst)# end

Verifying ERSPAN

To verify the ERSPAN configuration, use the following commands:

The following is sample output from the show monitor session erspan-source command: 

Device# show monitor session erspan-source
 
Type : ERSPAN Source Session
Status : Admin Enabled
Source Ports :
RX Only : Gi1/4/33
Destination IP Address : 192.0.2.1
Destination ERSPAN ID : 110
Origin IP Address : 10.10.10.216
IPv6 Flow Label : None

The following is sample output from the show monitor session erspan-source detail command: 

Device# show monitor session erspan-source detail

Type : ERSPAN Source Session
Status : Admin Enabled
Description : -
Source Ports :
RX Only : Gi1/4/33
TX Only : None
Both : None
Source VLANs :
RX Only : None
TX Only : None
Both : None
Source RSPAN VLAN : None
Destination Ports : None
Filter VLANs : None
Filter Addr Type :
RX Only : None
TX Only : None
Both : None
Filter Pkt Type :
RX Only : None
Dest RSPAN VLAN : None
IP Access-group : None
IPv6 Access-group : None
Destination IP Address : 192.0.2.1
Destination IPv6 Address : None
Destination IP VRF : None
Destination ERSPAN ID : 110
Origin IP Address : 10.10.10.216
IP QOS PREC : 0
IP TTL : 255

The following output from the show capability feature monitor erspan-source command displays information about the configured ERSPAN source sessions: 

Device# show capability feature monitor erspan-source
 
ERSPAN Source Session Supported: true
No of Rx ERSPAN source session: 8
No of Tx ERSPAN source session: 8
ERSPAN Header Type supported: II and III
ACL filter Supported: true
Fragmentation Supported: true
Truncation Supported: false
Sequence number Supported: false
QOS Supported: true

The following output from the show capability feature monitor erspan-destination command displays all the configured global built-in templates: 

Device# show capability feature monitor erspan-destination
 
ERSPAN Destination Session Supported: false

Additional References

RFCs

Standard/RFC Title

RFC 2784

Generic Routing Encapsulation (GRE)

Technical Assistance

Description Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/support

Feature Information for Configuring ERSPAN

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1. Feature Information for Configuring ERSPAN

Feature Name

Releases

Feature Information

ERSPAN

Cisco IOS XE Everest 16.5.1a

This feature was introduced.

ERSPAN

Cisco IOS XE Gibraltar 16.11.1

Support of destination sessions was introduced.

The vrf and ip dscp commands, and the sgt keyword were introduced.

ERSPAN has been enhanced to configure a device to Type-III header.

The header-type 3 command was introduced.

Support of ERSPAN truncation and timestamp was introduced.

The mtu command was introduced.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco