Confused about the ERSPAN IP addresses

[Mitrixsen]

Hello, everyone.

I am a little confused about the ERSPAN configuration. Take a look at this:

My goal is to send any traffic sent between R1 and PC2 towards the WIRESHARK device-.

May I know, why is the ip address command necessary on R2? Isn't the entire source section telling it to send anything that it receives, that is coming from a SPAN session identified with 200, towards the G2 destination SPAN interface?

Why is the ip address command on R2 necessary? I could not get this to work without it.

It makes sense why its on R1 since it tells R1 to use the 192.168.12.2 IP as the destination when tunneling but why on R2?

Thank you.

David

[M02@rt37 · Accepted solution]

Hello David,

When R1 sends ERSPAN trafic, it encapsulates it using the destination IP address 192.168.12.2 configured on the source session. R2, as the ERSPAN destination, must be explicitly configured with this IP so that it knows which traffic to accept and process..

Without the ip address definition, R2 would not recognize or properly match incoming erspan traffic. The erspan-id 200 helps identify the specific erspan session, but the IP address is still required for the correct reception and handling of packets.