Configuring ERSPAN

This chapter contains the following sections:

Information About ERSPAN

The Cisco NX-OS system supports the Encapsulated Remote Switching Port Analyzer (ERSPAN) feature on both source and destination ports. ERSPAN transports mirrored traffic over an IP network.

ERSPAN consists of an ERSPAN source session, routable ERSPAN generic routing encapsulation (GRE)-encapsulated traffic, and an ERSPAN destination session. You can separately configure ERSPAN source sessions and destination sessions on different switches.

ERSPAN Types

ERSPAN Type III supports all of the ERSPAN Type II features and functionality and adds these enhancements:

  • Provides timestamp information in the ERSPAN Type III header that can be used to calculate packet latency among edge, aggregate, and core switches.

  • Identifies possible traffic sources using the ERSPAN Type III header fields.

ERSPAN Sources

The interfaces from which traffic can be monitored are called ERSPAN sources. Sources designate the traffic to monitor and whether to copy ingress, egress, or both directions of traffic. ERSPAN sources include the following:

  • Ethernet ports and port channels.

  • VLANs—When a VLAN is specified as an ERSPAN source, all supported interfaces in the VLAN are ERSPAN sources.

ERSPAN source ports have the following characteristics:

  • A port configured as a source port cannot also be configured as a destination port.

  • ERSPAN does not monitor any packets that are generated by the supervisor, regardless of their source.

  • Ingress traffic at source ports can be filtered by using ACLs so that they mirror only those packets of information that match the ACL criteria.

ERSPAN Destinations

ERSPAN destination sessions capture packets sent by ERSPAN source sessions on Ethernet ports or port channels and send them to the destination port. Destination ports receive the copied traffic from ERSPAN sources.

ERSPAN destination sessions are identified by the configured source IP address and ERSPAN ID. This allows multiple source sessions to send ERSPAN traffic to the same destination IP and ERSPAN ID and allows you to have multiple sources terminating at a single destination simultaneously.

ERSPAN destination ports have the following characteristics:

  • A port configured as a destination port cannot also be configured as a source port.

  • Destination ports do not participate in any spanning tree instance or any Layer 3 protocols.

  • Ingress and ingress learning options are not supported on monitor destination ports.

  • Host Interface (HIF) port channels and fabric port channel ports are not supported as SPAN destination ports.

ERSPAN Sessions

You can create ERSPAN sessions that designate sources and destinations to monitor.

When configuring ERSPAN source sessions, you must configure the destination IP address. When configuring ERSPAN destination sessions, you must configure the source IP address. See ERSPAN Sources for the properties of source sessions and ERSPAN Destinations for the properties of destination sessions.


Note

Only eight unidirectional, or four bidirectional ERSPAN or SPAN source sessions can run simultaneously across all switches. Only 20 ERSPAN destination sessions can run simultaneously across all switches.

The following figure shows an ERSPAN configuration.

Figure 1. ERSPAN Configuration

Multiple ERSPAN Sessions

You can define up to eight unidirectional ERSPAN source or SPAN sessions, or four bidirectional ERSPAN source or SPAN sessions at one time. You can shut down any unused ERSPAN sessions.

For information about shutting down ERSPAN sessions, see Shutting Down or Activating an ERSPAN Session.

ERSPAN Marker Packet

The type III ERSPAN header carries a hardware generated 32-bit timestamp. This timestamp field wraps periodically. When the switch is set to 1 ns granularity, this field wraps every 4.29 seconds. Such a wrap time makes it difficult to interpret the real value of the timestamp.

To recover the real value of the ERSPAN timestamp, Cisco NX-OS Release 6.0(2)A4(1) introduces a periodical marker packet to carry the original UTC timestamp information and provide a reference for the ERSPAN timestamp. The marker packet is sent out in 1-second intervals. Therefore, the destination site can detect the 32-bit wrap by checking the difference between the timestamp of the reference packet and the packet order.

High Availability

The ERSPAN feature supports stateless and stateful restarts. After a reboot or supervisor switchover, the running configuration is applied.

Prerequisites for ERSPAN

ERSPAN has the following prerequisite:

  • You must first configure the Ethernet interfaces for ports on each device to support the desired ERSPAN configuration. For more information, see the Interfaces configuration guide for your platform.

Guidelines and Limitations for ERSPAN

ERSPAN has the following configuration guidelines and limitations:

  • ERSPAN supports the following:

    • ERSPAN source session type (Packets are encapsulated as GRE-tunnel packets and sent on the IP network.)

    • ERSPAN destination session type (Support for decapsulating the ERSPAN packet is available. The encapsulated packet is decapsulated at the destination box and the plain decapsulated packet is spanned to a front panel port at the ERSPAN terminating point.)

  • ERSPAN source sessions are shared with local SPAN sessions. You can configure a maximum of eight ERSPAN source or SPAN source sessions in a single direction; If both receive and transmit sources are configured in the same session, it counts as two sessions and you can configure four such bidirectional sessions at one time.

  • If you install Cisco NX-OS 5.0(3)U2(2), configure ERSPAN, and then downgrade to a lower version of software, the ERSPAN configuration is lost. This situation occurs because ERSPAN is not supported in versions before Cisco NX-OS 5.0(3)U2(2).

    For information about a similar SPAN limitation, see Guidelines and Limitations for SPAN.

  • ERSPAN is not supported for packets generated by the supervisor.

  • ERSPAN sessions are terminated identically at the destination router.

  • ERSPAN is not supported for management ports.

  • A destination port can be configured in multiple ERSPAN session at a time.

  • You cannot configure a port as both a source and destination port.

  • A single ERSPAN session can include mixed sources in any combination of the following:

    • Ethernet ports or port channels but not subinterfaces.

    • VLANs or port channels, which can be assigned to port channel subinterfaces.

    • The port channels to the control plane CPU.


      Note
      ERSPAN does not monitor any packets that are generated by the supervisor, regardless of their source.

  • Destination ports do not participate in any spanning tree instance or Layer 3 protocols.

  • When an ERSPAN session contains source ports that are monitored in the transmit or transmit and receive direction, packets that these ports receive may be replicated to the ERSPAN destination port even though the packets are not actually transmitted on the source ports. Some examples of this behavior on source ports include:

    • Traffic that results from flooding

    • Broadcast and multicast traffic

  • When Nexus 3548 is the ERSPAN destination, GRE headers are stripped off before sending mirrored packets out of the terminating point.

  • ERSPAN does not support 1588 granularity mode, and rejects this mode if selected.

  • ERSPAN supports 100 microseconds (ÎĽs), 100 nanoseconds (ns), and ns granularity.

  • ERSPAN sends all timestamps in 32-bit format. Therefore, the timestamp field will wrap periodically. When the switch is set to ns granularity, this field will wrap every 4.29 seconds.

  • A Layer 3 subinterface cannot be configured as an ERSPAN source interface.

  • All ERSPAN sources terminating in a single destination box must use the same destination IP address.

  • You cannot configure different source IP addresses in different ERSPAN destination sessions.

  • Layer 3 switched traffic from VLAN X to VLAN Y, which is spanned through the ERSPAN source in either the Rx or Tx direction, will carry VLAN information in the ERSPAN header of VLAN X (the VLAN before Layer 3 switching or ingress VLAN).

  • Multicast flood packets that do not go out of the ERSPAN source interface, which is configured for the egress (Tx) direction, can still reach the ERSPAN destination. This is because egress spanned packets are spanned before the original egress port is selectively enabled to receive specific frames and drop others, whereas the span for the Nexus 3548 switch application-specific integrated circuit (ASIC) is based on the monitor port's property. As a result, the spanned packet is still sent to the remote destination. This is expected behavior from platforms specific to multicast flood and is not seen for other traffic streams.

  • Replicated multicast packets sent out of the ERSPAN source in the Tx direction are not sent to the ERSPAN destination.

  • You can monitor the same source interfaces (physical port or port-channel) in multiple ERSPAN (type 2 or type 3) sessions.

  • Configuring IP Filter on ERSPAN or Local SPAN with VLAN as source is not supported.

Default Settings for ERSPAN

The following table lists the default settings for ERSPAN parameters.

Table 1. Default ERSPAN Parameters

Parameters

Default

ERSPAN sessions

Created in the shut state.

Configuring ERSPAN

Configuring an ERSPAN Source Session

You can configure an ERSPAN session on the local device only. By default, ERSPAN sessions are created in the shut state.

For sources, you can specify Ethernet ports, port channels, and VLANs. A single ERSPAN session can include mixed sources in any combination of Ethernet ports or VLANs.


Note

ERSPAN does not monitor any packets that are generated by the supervisor, regardless of their source.

SUMMARY STEPS

  1. configure terminal
  2. monitor erspan origin ip-address ip-address global
  3. monitor erspan granularity 100_ns{100_us|100_ns|ns}
  4. no monitor session {session-number | all}
  5. monitor session {session-number | all} type erspan-source
  6. header-type version
  7. description description
  8. source {[interface[type slot/port[-port][, type slot/port[-port]]] [port-channel channel-number]] | [vlan {number | range}]} [rx | tx | both]
  9. (Optional) Repeat Step 6 to configure all ERSPAN sources.
  10. destination ip ip-address
  11. erspan-id erspan-id
  12. vrf vrf-name
  13. (Optional) ip ttl ttl-number
  14. (Optional) ip dscp dscp-number
  15. no shut
  16. (Optional) show monitor session {all | session-number | range session-range}
  17. (Optional) show running-config monitor
  18. (Optional) show startup-config monitor
  19. (Optional) copy running-config startup-config

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

switch# config t
switch(config)#

Enters global configuration mode.

Step 2

monitor erspan origin ip-address ip-address global

Example:

switch(config)# monitor erspan origin 
ip-address 10.0.0.1 global

Configures the ERSPAN global origin IP address.

Step 3

monitor erspan granularity 100_ns{100_us|100_ns|ns}

Example:

switch(config)# monitor erspan granularity 100_ns

Configures the granularity of all ERSPAN sessions.

Step 4

no monitor session {session-number | all}

Example:

switch(config)# no monitor session 3

Clears the configuration of the specified ERSPAN session. The new session configuration is added to the existing session configuration.

Step 5

monitor session {session-number | all} type erspan-source

Example:

switch(config)# monitor session 3 type erspan-source
switch(config-erspan-src)#

Configures an ERSPAN source session.

Step 6

header-type version

Example:

switch(config-erspan-src)# header-type 3

(Optional) Changes the ERSPAN source session from Type II to Type III.

Step 7

description description

Example:

switch(config-erspan-src)# description erspan_src_session_3

Configures a description for the session. By default, no description is defined. The description can be up to 32 alphanumeric characters.

Step 8

source {[interface[type slot/port[-port][, type slot/port[-port]]] [port-channel channel-number]] | [vlan {number | range}]} [rx | tx | both]

Example:

switch(config-erspan-src)# source interface ethernet 2/1-3, ethernet 3/1 rx

Example:

switch(config-erspan-src)# source interface port-channel 2

Example:

switch(config-erspan-src)# source interface sup-eth 0 both

Example:

switch(config-monitor)# source interface ethernet 101/1/1-3

Step 9

(Optional) Repeat Step 6 to configure all ERSPAN sources.

(Optional)

—

Step 10

destination ip ip-address

Example:

switch(config-erspan-src)# destination ip 10.1.1.1

Configures the destination IP address in the ERSPAN session. Only one destination IP address is supported per ERSPAN source session.

Step 11

erspan-id erspan-id

Example:

switch(config-erspan-src)# erspan-id 5

Configures the ERSPAN ID for the ERSPAN source session. The ERSPAN range is from 1 to 1023. This ID uniquely identifies a source and destination ERSPAN session pair. The ERSPAN ID configured in the corresponding destination ERSPAN session must be same as the one configured in the source session.

Step 12

vrf vrf-name

Example:

switch(config-erspan-src)# vrf default

Configures the VRF that the ERSPAN source session uses for traffic forwarding.

Step 13

(Optional) ip ttl ttl-number

Example:

switch(config-erspan-src)# ip ttl 25
 (Optional)

Configures the IP time-to-live (TTL) value for the ERSPAN traffic. The range is from 1 to 255.

Step 14

(Optional) ip dscp dscp-number

Example:

switch(config-erspan-src)# ip dscp 42
 (Optional)

Configures the differentiated services code point (DSCP) value of the packets in the ERSPAN traffic. The range is from 0 to 63.

Step 15

no shut

Example:

switch(config-erspan-src)# no shut
Enables the ERSPAN source session. By default, the session is created in the shut state.

Note

 

Only two ERSPAN source sessions can be running simultaneously.

Step 16

(Optional) show monitor session {all | session-number | range session-range}

Example:

switch(config-erspan-src)# show monitor session 3
 (Optional)

Displays the ERSPAN session configuration.

Step 17

(Optional) show running-config monitor

Example:

switch(config-erspan-src)# show running-config monitor
 (Optional)

Displays the running ERSPAN configuration.

Step 18

(Optional) show startup-config monitor

Example:

switch(config-erspan-src)# show startup-config monitor
 (Optional)

Displays the ERSPAN startup configuration.

Step 19

(Optional) copy running-config startup-config

Example:

switch(config-erspan-src)# copy running-config startup-config
 (Optional)

Copies the running configuration to the startup configuration.

Configuring an ERSPAN Destination Session

You can configure an ERSPAN destination session to copy packets from a source IP address to destination ports on the local device. By default, ERSPAN destination sessions are created in the shut state.

Before you begin

Ensure that you have already configured the destination ports in monitor mode.

SUMMARY STEPS

  1. config t
  2. interface ethernet slot/port[-port]
  3. switchport
  4. switchport mode [access | trunk]
  5. switchport monitor
  6. Repeat Steps 2 to 5 to configure monitoring on additional ERSPAN destinations.
  7. no monitor session {session-number | all}
  8. monitor session {session-number | all} type erspan-destination
  9. description description
  10. source ip ip-address
  11. destination {[interface [type slot/port[-port], [type slot/port [port]]]}
  12. erspan-id erspan-id
  13. no shut
  14. (Optional) show monitor session {all | session-number | range session-range}
  15. (Optional) show running-config monitor
  16. (Optional) show startup-config monitor
  17. (Optional) copy running-config startup-config

DETAILED STEPS

  Command or Action Purpose

Step 1

config t

Example:

switch# config t
switch(config)#

Enters global configuration mode.

Step 2

interface ethernet slot/port[-port]

Example:

switch(config)# interface ethernet 2/5
switch(config-if)#

Enters interface configuration mode on the selected slot and port or range of ports.

Step 3

switchport

Example:

switch(config-if)# switchport

Configures switchport parameters for the selected slot and port or range of ports.

Step 4

switchport mode [access | trunk]

Example:

switch(config-if)# switchport mode trunk

Configures the following switchport modes for the selected slot and port or range of ports:

  • access

  • trunk

Step 5

switchport monitor

Example:

switch(config-if)# switchport monitor

Configures the switch interface in monitor mode.

To configure an interface to be an ERSPAN or SPAN destination (using the destination interface ethernet interface command), it must first be configured in monitor mode.

Step 6

Repeat Steps 2 to 5 to configure monitoring on additional ERSPAN destinations.

—

Step 7

no monitor session {session-number | all}

Example:

switch(config-if)# no monitor session 3

Clears the configuration of the specified ERSPAN session. The new session configuration is added to the existing session configuration.

Step 8

monitor session {session-number | all} type erspan-destination

Example:

switch(config-if)# monitor session 3 type erspan-destination
switch(config-erspan-dst)#

Configures an ERSPAN destination session.

Step 9

description description

Example:

switch(config-erspan-dst)# description erspan_dst_session_3

Configures a description for the session. By default, no description is defined. The description can be up to 32 alphanumeric characters.

Step 10

source ip ip-address

Example:

switch(config-erspan-dst)# source ip 10.1.1.1

Configures the source IP address in the ERSPAN session. Only one source IP address is supported per ERSPAN destination session.

This IP address must match the destination IP address that is configured in the corresponding ERSPAN source session.

Step 11

destination {[interface [type slot/port[-port], [type slot/port [port]]]}

Example:

switch(config-erspan-dst)# destination interface ethernet 2/5

Configures a destination for copied source packets. You can configure only interfaces as a destination.

Note

 
You can configure destination ports as trunk ports.

Step 12

erspan-id erspan-id

Example:

switch(config-erspan-dst)# erspan-id 5

Configures the ERSPAN ID for the ERSPAN session. The range is from 1 to 1023. This ID uniquely identifies a source and destination ERSPAN session pair. The ERSPAN ID configured in the corresponding destination ERSPAN session must be same as the one configured in the source session.

Step 13

no shut

Example:

switch(config)# no shut

Enables the ERSPAN destination session. By default, the session is created in the shut state.

Note

 
Only 16 active ERSPAN destination sessions can be running simultaneously.

Step 14

(Optional) show monitor session {all | session-number | range session-range}

Example:

switch(config)# show monitor session 3
 (Optional)

Displays the ERSPAN session configuration.

Step 15

(Optional) show running-config monitor

Example:

switch(config-erspan-src)# show running-config monitor
 (Optional)

Displays the running ERSPAN configuration.

Step 16

(Optional) show startup-config monitor

Example:

switch(config-erspan-src)# show startup-config monitor
 (Optional)

Displays the ERSPAN startup configuration.

Step 17

(Optional) copy running-config startup-config

Example:

switch(config-erspan-src)# copy running-config startup-config
 (Optional)

Copies the running configuration to the startup configuration.

Shutting Down or Activating an ERSPAN Session

You can shut down ERSPAN sessions to discontinue the copying of packets from sources to destinations. Because only a specific number of ERSPAN sessions can be running simultaneously, you can shut down a session to free hardware resources to enable another session. By default, ERSPAN sessions are created in the shut state.

You can enable ERSPAN sessions to activate the copying of packets from sources to destinations. To enable an ERSPAN session that is already enabled but operationally down, you must first shut it down and then enable it. You can shut down and enable the ERSPAN session states with either a global or monitor configuration mode command.

SUMMARY STEPS

  1. configuration terminal
  2. monitor session {session-range | all} shut
  3. no monitor session {session-range | all} shut
  4. monitor session session-number type erspan-source
  5. monitor session session-number type erspan-destination
  6. shut
  7. no shut
  8. (Optional) show monitor session all
  9. (Optional) show running-config monitor
  10. (Optional) show startup-config monitor
  11. (Optional) copy running-config startup-config

DETAILED STEPS

  Command or Action Purpose

Step 1

configuration terminal

Example:

switch# configuration terminal
switch(config)#

Enters global configuration mode.

Step 2

monitor session {session-range | all} shut

Example:

switch(config)# monitor session 3 shut

Shuts down the specified ERSPAN sessions. The session range is from 1 to 48.. By default, sessions are created in the shut state.

Step 3

no monitor session {session-range | all} shut

Example:

switch(config)# no monitor session 3 shut
Resumes (enables) the specified ERSPAN sessions. The session range is from 1 to 48.. By default, sessions are created in the shut state. .

Note

 

If a monitor session is enabled but its operational status is down, then to enable the session, you must first specify the monitor session shut command followed by the no monitor session shut command.

Step 4

monitor session session-number type erspan-source

Example:

switch(config)# monitor session 3 type erspan-source
switch(config-erspan-src)#

Enters the monitor configuration mode for the ERSPAN source type. The new session configuration is added to the existing session configuration.

Step 5

monitor session session-number type erspan-destination

Example:

switch(config-erspan-src)# monitor session 3 type erspan-destination

Enters the monitor configuration mode for the ERSPAN destination type.

Step 6

shut

Example:

switch(config-erspan-src)# shut

Shuts down the ERSPAN session. By default, the session is created in the shut state.

Step 7

no shut

Example:

switch(config-erspan-src)# no shut

Enables the ERSPAN session. By default, the session is created in the shut state.

Step 8

(Optional) show monitor session all

Example:

switch(config-erspan-src)# show monitor session all
 (Optional)

Displays the status of ERSPAN sessions.

Step 9

(Optional) show running-config monitor

Example:

switch(config-erspan-src)# show running-config monitor
 (Optional)

Displays the running ERSPAN configuration.

Step 10

(Optional) show startup-config monitor

Example:

switch(config-erspan-src)# show startup-config monitor
 (Optional)

Displays the ERSPAN startup configuration.

Step 11

(Optional) copy running-config startup-config

Example:

switch(config-erspan-src)# copy running-config startup-config
 (Optional)

Copies the running configuration to the startup configuration.

Configuring ERSPAN Filtering

You can configure SPAN filters for local and ERSPAN-source sessions only. SPAN and ERSPAN Filtering provides more information about filters.

SUMMARY STEPS

  1. switch# configure terminal
  2. switch(config)# monitor session {session-number | all} type erspan-source
  3. switch(config-erspan-src)# filter {ip source-ip-address source-ip-mask destination-ip-address destination-ip-mask}
  4. switch(config-erspan-src)# erspan-id erspan-id
  5. switch(config-erspan-src)# vrf vrf-name
  6. switch(config-erspan-src)# destination ip ip-address
  7. switch(config-erspan-src)# source [interface [type slot/port] | port-channel channel-number] | [vlan vlan-range] [rx | tx | both]

DETAILED STEPS

  Command or Action Purpose

Step 1

switch# configure terminal

Enters global configuration mode.

Step 2

switch(config)# monitor session {session-number | all} type erspan-source

Configures an ERSPAN source session.

Step 3

switch(config-erspan-src)# filter {ip source-ip-address source-ip-mask destination-ip-address destination-ip-mask}

Creates an ERSPAN filter.

Step 4

switch(config-erspan-src)# erspan-id erspan-id

Configures the ERSPAN ID for the ERSPAN source session. The ERSPAN range is from 1 to 1023. This ID uniquely identifies a source and destination ERSPAN session pair. The ERSPAN ID configured in the corresponding destination ERSPAN session must be same as the one configured in the source session.

Step 5

switch(config-erspan-src)# vrf vrf-name

Configures the VRF that the ERSPAN source session uses for traffic forwarding.

Step 6

switch(config-erspan-src)# destination ip ip-address

Configures the destination IP address in the ERSPAN session. Only one destination IP address is supported per ERSPAN source session.

Step 7

switch(config-erspan-src)# source [interface [type slot/port] | port-channel channel-number] | [vlan vlan-range] [rx | tx | both]

Configures the sources and traffic direction in which to copy packets. You can enter a range of Ethernet ports, a port channel, or a range of VLANs.

You can configure one or more sources, as either a series of comma-separated entries or a range of numbers. You can specify up to 128 interfaces.

You can specify the traffic direction to copy as ingress, egress, or both. The default direction is both.

Example

The following example shows how to configure an MAC-based filter for an ERSPAN-source session: 

switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)# monitor session 2 type erspan-source
switch(config-erspan-src)# filter abcd.ef12.3456 1111.2222.3333 1234.5678.9012 1111.2222.3333
switch(config-erspan-src)# erspan-id 20
switch(config-erspan-src)# vrf default
switch(config-erspan-src)# destination ip 200.1.1.1
switch(config-erspan-src)# source interface Ethernet 1/47 rx
switch(config-erspan-src)# no shut
switch(config-erspan-src)#

The following example shows how to configure a VLAN-based filter for an ERSPAN-source session: 

switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)# monitor session 2 type erspan-source
switch(config-erspan-src)# filter abcd.ef12.3456 1111.2222.3333 1234.5678.9012 1111.2222.3333
switch(config-erspan-src)# erspan-id 21
switch(config-erspan-src)# vrf default
switch(config-erspan-src)# destination ip 200.1.1.1
switch(config-erspan-src)# source interface Ethernet 1/47 rx
switch(config-erspan-src)# source vlan 315
switch(config-erspan-src)# mtu 200
switch(config-erspan-src)# no shut
switch(config-erspan-src)#

Configuring ERSPAN Sampling

You can configure sampling for local and ERSPAN-source sessions only. SPAN and ERSPAN Sampling provides more information about sampling.

SUMMARY STEPS

  1. switch# configure terminal
  2. switch(config)# monitor session {session-number | all} type erspan-source
  3. switch(config-erspan-src)# sampling sampling-range
  4. switch(config-erspan-src)# erspan-id erspan-id
  5. switch(config-erspan-src)# vrf vrf-name
  6. switch(config-erspan-src)# destination ip ip-address
  7. switch(config-erspan-src)# source [interface type slot/port | port-channel channel-number] | [vlan vlan-range] [rx | tx | both]

DETAILED STEPS

  Command or Action Purpose

Step 1

switch# configure terminal

Enters global configuration mode.

Step 2

switch(config)# monitor session {session-number | all} type erspan-source

Configures an ERSPAN source session.

Step 3

switch(config-erspan-src)# sampling sampling-range

Configures a range for spanning packets. If the range is defined as n, every nth packet will be spanned.

The sampling range is between 2 and 1023.

Step 4

switch(config-erspan-src)# erspan-id erspan-id

Configures the ERSPAN ID for the ERSPAN source session. The ERSPAN range is from 1 to 1023. This ID uniquely identifies a source and destination ERSPAN session pair. The ERSPAN ID configured in the corresponding destination ERSPAN session must be same as the one configured in the source session.

Step 5

switch(config-erspan-src)# vrf vrf-name

Configures the VRF that the ERSPAN source session uses for traffic forwarding.

Step 6

switch(config-erspan-src)# destination ip ip-address

Configures the destination IP address in the ERSPAN session. Only one destination IP address is supported per ERSPAN source session.

Step 7

switch(config-erspan-src)# source [interface type slot/port | port-channel channel-number] | [vlan vlan-range] [rx | tx | both]

Configures the sources and traffic direction in which to copy packets. You can enter a range of Ethernet ports, a port channel, or a range of VLANs.

You can configure one or more sources, as either a series of comma-separated entries or a range of numbers. You can specify up to 128 interfaces.

You can specify the traffic direction to copy as ingress, egress, or both. The default direction is both.

Example

The following example shows how to configure sampling for an ERSPAN-source session: 

switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)# monitor session 2 type erspan-source
switch(config-erspan-src)# sampling 40
switch(config-erspan-src)# erspan-id 30
switch(config-erspan-src)# vrf default
switch(config-erspan-src)# destination ip 200.1.1.1
switch(config-erspan-src)# source interface ethernet 1/47
switch(config-erspan-src)# show monitor session 2
session 2
---------------
type : erspan-source
state : up
granularity : 100 microseconds
erspan-id : 30
vrf-name : default
destination-ip : 200.1.1.1
ip-ttl : 255
ip-dscp : 0
header-type : 2
mtu : 200
sampling : 40
origin-ip : 150.1.1.1 (global)
source intf :
rx : Eth1/47
tx : Eth1/47
both : Eth1/47
source VLANs :
rx : 315
switch(config-erspan-src)#

Configuring ERSPAN Truncation

You can configure truncation for local and ERSPAN-source sessions only. SPAN and ERSPAN Truncation provides more information about truncation.

SUMMARY STEPS

  1. switch# configure terminal
  2. switch(config)# monitor session {session-number | all} type erspan-source
  3. switch(config-erspan-src)# mtu size
  4. switch(config-erspan-src)# erspan-id erspan-id
  5. switch(config-erspan-src)# vrf vrf-name
  6. switch(config-erspan-src)# destination ip ip-address
  7. switch(config-erspan-src)# source [interface type slot/port | port-channel channel-number] | [vlan vlan-range] [rx | tx | both]

DETAILED STEPS

  Command or Action Purpose

Step 1

switch# configure terminal

Enters global configuration mode.

Step 2

switch(config)# monitor session {session-number | all} type erspan-source

Configures an ERSPAN source session.

Step 3

switch(config-erspan-src)# mtu size

Configures the MTU size for truncation. Any SPAN packet that is larger than the configured MTU size is truncated to the configured size with a 4-byte offset.

The MTU truncation size is between 64 bytes and 1518 bytes.

Step 4

switch(config-erspan-src)# erspan-id erspan-id

Configures the ERSPAN ID for the ERSPAN source session. The ERSPAN range is from 1 to 1023. This ID uniquely identifies a source and destination ERSPAN session pair. The ERSPAN ID configured in the corresponding destination ERSPAN session must be same as the one configured in the source session.

Step 5

switch(config-erspan-src)# vrf vrf-name

Configures the VRF that the ERSPAN source session uses for traffic forwarding.

Step 6

switch(config-erspan-src)# destination ip ip-address

Configures the destination IP address in the ERSPAN session. Only one destination IP address is supported per ERSPAN source session.

Step 7

switch(config-erspan-src)# source [interface type slot/port | port-channel channel-number] | [vlan vlan-range] [rx | tx | both]

Configures the sources and traffic direction in which to copy packets. You can enter a range of Ethernet ports, a port channel, or a range of VLANs.

You can configure one or more sources, as either a series of comma-separated entries or a range of numbers. You can specify up to 128 interfaces.

You can specify the traffic direction to copy as ingress, egress, or both. The default direction is both.

Example

The following example shows how to configure MTU truncation for an ERSPAN-source session: 

switch# configure terminal
switch(config)# monitor session 6 type erspan-source
switch(config-erspan-src)# mtu 1096
switch(config-erspan-src)# erspan-id 40
switch(config-erspan-src)# vrf default
switch(config-erspan-src)# destination ip 200.1.1.1
switch(config-erspan-src)# source interface ethernet 1/40
switch(config-erspan-src)# show monitor session 6
session 6
---------------
type : erspan-source
state : down (Session admin shut)
granularity : 100 microseconds
erspan-id : 40
vrf-name : default
destination-ip : 200.1.1.1
ip-ttl : 255
ip-dscp : 0
header-type : 2
mtu : 1096
origin-ip : 150.1.1.1 (global)
source intf :
rx : Eth1/40
tx : Eth1/40
both : Eth1/40
source VLANs :
rx :

Configuring an ERSPAN Marker Packet

Use the following commands to configure an ERSPAN marker packet:

Command

Purpose

marker-packet seconds

Enables the ERSPAN marker packet for a session.

The interval can range from 1 second to 4 seconds.

marker-packet milliseconds

Enables the ERSPAN marker packet for a session.

The interval can range from 100 milliseconds to 900 milliseconds, with increments in multiples of 100.

no marker-packet

Disables the ERSPAN marker packet for a session.

Example

This example shows how to enable the ERSPAN marker packet with an interval of 2 seconds:


Note

Configuring the interval parameter is optional. If you enable the marker-packet without specifying a parameter, it uses the default or existing interval as the interval value. The marker-packet command only enables the marker-packet. 

switch# configure terminal
switch(config)# monitor erspan origin ip-address 172.28.15.250 global
switch(config)# monitor session 1 type erspan-source
switch(config)# header-type 3
switch(config-erspan-src)# erspan-id 1
switch(config-erspan-src)# ip ttl 16
switch(config-erspan-src)# ip dscp 5
switch(config-erspan-src)# vrf default
switch(config-erspan-src)# destination ip 9.1.1.2
switch(config-erspan-src)# source interface e1/15 both
switch(config-erspan-src)# marker-packet 2
switch(config-erspan-src)# no shut
switch(config-erspan-src)# exit

Verifying the ERSPAN Configuration

Use the following command to verify the ERSPAN configuration information:

Command

Purpose

show monitor session {all | session-number | range session-range}

Displays the ERSPAN session configuration.

show running-config monitor

Displays the running ERSPAN configuration.

show startup-config monitor

Displays the ERSPAN startup configuration.

Configuration Examples for ERSPAN

Configuration Example for an ERSPAN Source Session

The following example shows how to configure an ERSPAN source session: 

switch# config t
switch(config)# interface e14/30
switch(config-if)# no shut
switch(config-if)# exit
switch(config)# monitor erspan origin ip-address 3.3.3.3 global
switch(config)# monitor erspan granularity 100_ns
switch(config-erspan-src)# header-type 3
switch(config)# monitor session 1 type erspan-source
switch(config-erspan-src)# source interface e14/30
switch(config-erspan-src)# erspan-id 1
switch(config-erspan-src)# ip ttl 16
switch(config-erspan-src)# ip dscp 5
switch(config-erspan-src)# destination ip 9.1.1.2
switch(config-erspan-src)# no shut
switch(config-erspan-src)# exit
switch(config)# show monitor session 1

Note
switch(config)# monitor erspan granularity 100_ns and switch(config-erspan-src)# header-type 3 are used only while configuring Type III source sessions.

Configuration Example for an ERSPAN Destination Session

The following example shows how to configure an ERSPAN destination session: 

switch# config t
switch(config)# interface e14/29
switch(config-if)# no shut
switch(config-if)# switchport
switch(config-if)# switchport monitor
switch(config-if)# exit
switch(config)# monitor session 2 type erspan-destination
switch(config-erspan-dst)# source ip 9.1.1.2
switch(config-erspan-dst)# destination interface e14/29
switch(config-erspan-src)# erspan-id 1
switch(config-erspan-dst)# no shut
switch(config-erspan-dst)# exit
switch(config)# show monitor session 2

Additional References

Related Documents

Related Topic

Document Title

ERSPAN commands: complete command syntax, command modes, command history, defaults, usage guidelines, and examples

Cisco Nexus NX-OS System Management Command Reference for your platform.