4.3 Configure SPAN/RSPAN/ERSPAN

What this objective tests

Sometimes counters and logs are not enough. You need to see the packets. Switched Port Analyzer (SPAN) copies traffic from a source to an analyzer. The exam tests the three variants and the basic configuration of each.

Local SPAN

Source interface Gi1/0/1 carries user traffic. The analyzer connects to Gi1/0/48 on the same switch:

conf t
monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination interface GigabitEthernet1/0/48 encapsulation replicate
end

• both mirrors received and transmitted traffic. Use rx or tx for one direction.
• encapsulation replicate keeps the original VLAN tag on the mirrored copy.

Note: A destination SPAN port stops normal switching. Do not connect an end user to it.

RSPAN with a dedicated VLAN

Remote SPAN (RSPAN) carries mirrored frames across a special VLAN. The source switch puts copies into the remote-span VLAN. Trunks carry it. The destination switch sends it to the analyzer.

Source switch SW1:

conf t
vlan 999
 name RSPAN-CAPTURE
 remote-span
!
monitor session 2 source interface GigabitEthernet1/0/1 both
monitor session 2 destination remote vlan 999
end

Trunk between the switches:

interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan add 999

Destination switch SW2:

conf t
vlan 999
 name RSPAN-CAPTURE
 remote-span
!
monitor session 2 source remote vlan 999
monitor session 2 destination interface GigabitEthernet1/0/48
end

Note: The RSPAN VLAN is a transport for copied frames. Do not use it for user traffic. Do not put access ports in it. It must exist as a remote-span VLAN on each switch in the path and be allowed on the trunks. Spanning tree keeps it loop-free, but the switches flood the copied frames across the whole VLAN.

Verify the transport on both switches:

show vlan remote-span
show interfaces trunk

ERSPAN configuration: source and destination

Encapsulated Remote SPAN (ERSPAN) wraps mirrored traffic in GRE and sends it over a routed network. A complete ERSPAN configuration has two halves: a source session on the switch near the traffic and a destination session on the device near the analyzer. Define a source session with a destination IP and an origin IP.

ERSPAN source on SW1:

conf t
monitor session 3 type erspan-source
 source interface GigabitEthernet1/0/1 both
 destination
  erspan-id 30
  ip address 10.20.20.20
  origin ip address 10.20.20.10
end

ERSPAN destination on the remote device:

conf t
monitor session 3 type erspan-destination
 destination interface GigabitEthernet1/0/48
 source
  erspan-id 30
  ip address 10.20.20.10
end

• ip address 10.20.20.20 on the source is the tunnel destination IP: the analyzer-side device.
• origin ip address 10.20.20.10 is the tunnel source IP on SW1.
• The ERSPAN ID must match on both ends.

ERSPAN needs routed reachability between the two IPs. Check routing, ACLs on GRE, and MTU overhead before you blame the session.

Verify with show monitor session all

show monitor session all

Expected output for the three sessions above:

Session 1
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
Destination Ports      : Gi1/0/48
    Encapsulation      : Replicate

Session 2
---------
Type                   : Remote Source Session
Source Ports           :
    Both               : Gi1/0/1
Dest RSPAN VLAN        : 999

Session 3
---------
Type                   : ERSPAN Source Session
Source Ports           :
    Both               : Gi1/0/1
Destination IP Address : 10.20.20.20
Origin IP Address      : 10.20.20.10
ERSPAN ID              : 30

A configured session proves only that the switch tries to copy traffic. If the destination port or analyzer cannot keep up, the capture drops packets while production traffic continues.

Lab: build all three mirror types

Topology:

PC1 -- Gi1/0/1 [SW1] Gi1/0/24 ==== Gi1/0/24 [SW2] Gi1/0/48 -- Analyzer (VLAN 999 path)

PC1 -- [SW1] -- routed network -- [SW3] Gi1/0/48 -- Analyzer (ERSPAN path)
         origin 10.20.20.10            tunnel dest 10.20.20.20

Goal: mirror PC1 traffic three ways and verify each session.

Do these steps:

1. On SW1, configure local SPAN session 1: source Gi1/0/1 both, destination Gi1/0/48 with encapsulation replicate.
2. Verify with show monitor session 1. Generate traffic from PC1 and confirm the local analyzer sees it.
3. On SW1 and SW2, create VLAN 999 and set remote-span.
4. Allow VLAN 999 on the trunk between SW1 and SW2.
5. On SW1, configure session 2: source Gi1/0/1 both, destination remote vlan 999.
6. On SW2, configure session 2: source remote vlan 999, destination Gi1/0/48.
7. Verify with show vlan remote-span and show monitor session 2. Confirm the analyzer on SW2 sees PC1 packets.
8. On SW1, configure ERSPAN session 3: type erspan-source, source Gi1/0/1 both, erspan-id 30, destination ip 10.20.20.20, origin ip 10.20.20.10.
9. Verify routing with show ip route 10.20.20.20, then show monitor session 3.
10. Run show monitor session all and confirm all three sessions match the expected output above.

Expected result: session 1 is Local, session 2 is Remote Source with VLAN 999, session 3 is ERSPAN Source with the correct IPs. Each analyzer receives the mirrored PC1 traffic.

Exam traps

• Mirror two 1 Gbps directions into one 1 Gbps analyzer port and the capture drops packets. SPAN is a copy, not extra bandwidth.
• Mirroring only rx misses return traffic. Use both unless you know the direction you need.
• RSPAN can be correct on both switches and still fail if VLAN 999 is not allowed on the trunk path.
• The RSPAN VLAN is capture transport only. User ports in VLAN 999 break the design.
• ERSPAN needs routed reachability between origin and destination IPs. Check routing before the session config.
• Syntax varies by platform. Local SPAN and RSPAN use plain monitor session commands. ERSPAN uses monitor session ... type erspan-source.

Pass check

You are ready when you can do these things:

• Pick SPAN, RSPAN, or ERSPAN from a topology description.
• Configure all three session types with concrete interfaces, VLANs, and IPs.
• Read show monitor session all and name the type and state of each session.
• Explain why the RSPAN VLAN must stay free of user traffic.