ERSPAN Configuration Example (Encapsulated Remote SPAN) [EVE-ng]

ERSPAN Topology



ERSPAN Configuration


R1 Configuration

interface GigabitEthernet2
 ip address 192.168.10.254 255.255.255.0
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet3
 ip address 10.10.1.1 255.255.255.252
 negotiation auto
 no mop enabled
 no mop sysid

!

monitor session 10 type erspan-source
 description ## ERSPAN LearnDuty.com ##
 source interface Gi2
 destination
  erspan-id 100
  mtu 1464
  ip address 10.10.1.2
  origin ip address 10.10.1.1



R2 Configuration

interface GigabitEthernet2
 ip address 172.31.1.254 255.255.255.0
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet3
 ip address 10.10.1.2 255.255.255.252
 negotiation auto
 no mop enabled
 no mop sysid
!

monitor session 5 type erspan-destination
 destination interface Gi2
 source
  erspan-id 100
  ip address 10.10.1.2



ERSPAN Verification

On R1:

R1#show monitor session all
Session 10
----------
Type                     : ERSPAN Source Session
Status                   : Admin Enabled
Description              : ## ERSPAN LearnDuty.com ##
Source Ports             :
    Both                 : Gi2
Destination IP Address   : 10.10.1.2
MTU                      : 1464
Destination ERSPAN ID    : 100
Origin IP Address        : 10.10.1.1

On R2:

R2#show monitor session all
Session 5
---------
Type                     : ERSPAN Destination Session
Status                   : Admin Enabled
Destination Ports        : Gi2
Source IP Address        : 10.10.1.2
Source ERSPAN ID         : 100


ERSPAN Wireshark capture

We will start a ping from Web-server (192.168.10.1) to interface Gi2 (192.168.10.254) on Router R1, and we will check 2 Wireshark capture:

  • Wireshark Capture 1: on layer 3 link between R1 and R2 (GRE ERSPAN).
  • Wireshark Capture 2: on the interface eth0 on the sniffer side to confirm that ERSPAN is working properly.


Wireshark Capture 1 (interface Gi3 R1 or R2):


Wireshark Capture 2 (interface Eth0 on the Sniffer):

bilel949401

bilel949401

0 0 votes
Article Rating
Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments
Learn Duty
0
Would love your thoughts, please comment.x
()
x