You can do an access SPAN (ERSPAN) and actually can specify multiple ports to the source group. The destination group in your case would be your VM EP in the EPG. The only thing you have to make sure is that the VM you are sending the span to has an IP address. If you are only doing L2 in that BD (unicast routing disabled) it will not work.
We also have the option of a Local SPAN. This would only be desired if the source and destination were on the same leaf.
In summary :
Fabric Span (ERSPAN) - Span on fabric ports on spine or leaf - Source
Remote IP - Dest
Tenant Span (ERSPAN) - Span on EPG(VLAN) on Leaf - Source
Remote IP - Dest
Access Span (either) - Span on access ports ports on leaf - Source
Remote IP (ERSPAN) or Local Span (local port) - Destination
Regards,
Michael G.
Thank you for participating in the Cisco Support Forum for ACI! If you have other questions related to this post, please let us know. If this response answers your questions, please mark this post "answered" and assign a rating to the response(s) provided. This will help notify other viewers that your question(s) is answered and this helps us provide better responses for this and future questions.
