Configuring ERSPAN on IOS-XE

[zekebashi]

Hello,

We currently have RSPAN configured on C6504 (Config below). I need to migrate these configuration to C9500 (IOS-XE). I read the below documentations on how to configure ERSPAN and the config requires creating a GRE tunnel between two points. I am not clear on how do that. In the ERSPAN config requires two destination IP addresses and don't know of which devices  I need to put these IPs for. Any help would be greatly appreciated!!

RSPAN Config on C6504:

monitor session 2 type rspan-source
source interface Gi4/43
source interface Po25
destination remote vlan 3001
!
!
monitor session 3 type rspan-destination
source remote vlan 3001
destination interface Gi4/32

(https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/lanswitch/configuration/xe-16-7/lanswitch-xe-16-7-book/lnsw-conf-erspan.html#GUID-E7715831-5000-4345-8323-854D386652E5)

https://networklessons.com/cisco/ccie-routing-switching-written/erspan

[balaji.bandi]

ERSPAN run over L3 network, as long as source IP and destination IP reachable.

Source IP where you are capturing the monitor session

destination when you like to sniff the traffic or mirror the traffic

a good example here :

https://mrncciew.com/2017/08/17/configuring-erspan/

you can find config example :

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/16-9/configuration_guide/nmgmt/b_169_nmgmt_9500_cg/configuring_erspan.html

[zekebashi]

Thanks for the input, Balaji!

Using the example you provided, I am assuming that I can use the same IP Address for the destination and origin IP addresses if the both interfaces (source and destination )are on the same switch. Would that be correct?

Using your example:

HQ-SW:

      L0-y.y.y.3

      Src Port: G6/2    --- Interface traffic that need to be captured)

      Dest Port: T6/8  ---  Port Analyzer

===============================================

Config:

HQ-SW:

     monitor session 1 type erspan-source

     source interface g6/2

     destination ip address y.y.y.3

     origin ip address y.y.y.3

     erspan-id 62

monitor session 3 type erspan-destination

     destination interface Tengigabit6/8

     source ip address y.y.y.3

     erspan-id 62

     exit

============================================

Thanks in advance,

~zK