ERSPAN (Catalyst 3650 Switches)

cecilmayy · ‎10-08-2021

IOS XE Gibraltar 16.12.x (Catalyst 3650 Switches) support ERSPAN.
Can I send ERSPAN destination to a local RSPAN vlan on the destination switch. The command are available but I could not find any documentation to support the theory.

CORE- (config) #monitor session 66?
destination SPAN destination interface or VLAN
filter SPAN filter VLAN
source SPAN source interface, VLAN
type Type of monitor session

CORE- (config) #monitor session 66 destination?
interface SPAN destination interface
remote SPAN destination Remote

CORE- (config) #monitor session 66 destination remote?
vlan Remote SPAN destination RSPAN VLAN

CORE- (config) #monitor session 66 destination remote vlan?
<1006-4094> Remote SPAN destination extended RSPAN VLAN number
<2-1001> Remote SPAN destination RSPAN VLAN number

My idea is to create a RSPAN vlan on the destination switch and send all ERSPAN data to the RSPAN vlan and then pass the RSPAN vlan on a trunk to my virtual server.

pieterh · ‎10-14-2021

LAN Switching Configuration Guide, Cisco IOS XE Everest 16.6 - Configuring ERSPAN [Cisco ASR 1000 Series Aggregation Services Routers] - Cisco

ERSPAN Destination Ports
A destination port is a Layer 2 or Layer 3 LAN port to which ERSPAN sends traffic for analysis.

=> no (RSPAN) VLAN mentioned here only physical ports

pieterh · ‎10-14-2021

maybe this nformation from balaji.bandi helps

Source IP where you are capturing the monitor session
destination when you like to sniff the traffic or mirror the traffic

a good example here : https://mrncciew.com/2017/08/17/configuring-erspan/

you can find config example :
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/16-9/configuration_guide/nmgmt/b_169_nmgmt_9500_cg/configuring_erspan.html