Understanding How Local SPAN, RSPAN, and ERSPAN Work
ERSPAN Overview
ERSPAN supports source ports, source VLANs, and destination ports on different routers, which
provides remote monitoring of multiple routers across your network (see
ERSPAN consists of an ERSPAN source session, routable ERSPAN GRE-encapsulated traffic, and an
ERSPAN destination session. You separately configure ERSPAN source sessions and destination
sessions on different routers.
To configure an ERSPAN source session on one router, you associate a set of source ports or VLANs
with a destination IP address, ERSPAN ID number, and optionally with a VRF name. To configure an
ERSPAN destination session on another router, you associate the destination ports with the source IP
address, ERSPAN ID number, and optionally with a VRF name.
ERSPAN source sessions do not copy locally sourced RSPAN VLAN traffic from source trunk ports that
carry RSPAN VLANs. ERSPAN source sessions do not copy locally sourced ERSPAN
GRE-encapsulated traffic from source ports.
Each ERSPAN source session can have either ports or VLANs as sources, but not both.
The ERSPAN source session copies traffic from the source ports or source VLANs and forwards the
traffic using routable GRE-encapsulated packets to the ERSPAN destination session. The ERSPAN
destination session switches the traffic to the destination ports.
Figure 52-3 ERSPAN Configuration
Routed
GRE-encapsulated
traffic
Monitored Traffic
These sections describe the traffic that local SPAN, RSPAN, and ERSPAN can monitor:
•
•
•
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
52-4
Switch D
Routed
GRE-encapsulated
traffic
Routed
Network
A3
Switch A
A1
A2
Monitored Traffic Direction, page 52-5
Monitored Traffic, page 52-5
Duplicate Traffic, page 52-5
Chapter 52
D1
D2
Probe
Routed
GRE-encapsulated
traffic
B4
Switch B
B1 B2
B3
Configuring Local SPAN, RSPAN, and ERSPAN
Figure
52-3).
Destination switch
(data center)
Source switch(es)
(access)
OL-4266-08