how to configure span ports in SDA/DNAC environment

[nancyrawls]

How do you configure a span port on an SDA router?  C9500

Thanks.

[balaji.bandi]

check this user guide help you :

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/2-2-3/user_guide/b_cisco_dna_center_ug_2_2_3/b_cisco_dna_center_ug_2_2_3_chapter_01111.html?bookSearch=true

[jalejand]

What kind of SPAN?

SPAN (mirror a port and send the traffic to another port directly connected to the switch):

monitor session 1 
   source interface x/x both
   destination interface x/x encapsulation-replicate 

RSPAN (mirror a port and send the traffic on a VLAN instead): Rarely used in SDA as there are no trunks to work with

ERSPAN (mirror a port and send the traffic to a remote device, encapsulating the traffic on an IP /GRE tunnel):

ip access-list extended RTP

10 permit udp any any eq 1234 

monitor session 10 type erspan-source

 description RTP_Test     -

 source interface/vlan/etc

  filter ip access-group RTP   ----- ACL to only replicate relevant traffic

 destination

  erspan-id 100  

   mtu 9000 ----- Set by default

   ip address 192.168.32.11   ------- Remote recording / capture server

   origin ip address 172.19.1.72 --- Loopback 0 IP from the fabric node
   no shut

None of these can be yet automated by DNAC; the traffic copy feature can only support router platforms as per the time of this writting

[Mike.Cifelli]

@jalejand Does SDA support ERSPAN session across the fabric between two ENs? I have conducted several tests, but not getting expected results.  My test case platform info: Both ENs are C9300-48UXM running 17.03.04

[jedolphi]

Yes it does. Here's a config snip from my lab that works. Please open TAC case if it doesn't. Note below something is replacing the word a d d r e s s with **bleep**, seem it's being erroneously flagged as a swear word, sorry, nothing I can do about it.

SDA EN1 - ERSPAN source

monitor session 10 type erspan-source

source interface Gi1/0/23 - 24

destination

  erspan-id 101

  ip **bleep** 10.180.4.81

  origin ip **bleep** 10.180.4.80

SDA EN2 - ERSPAN destination

monitor session 10 type erspan-destination

destination interface Gi1/0/23

source

  erspan-id 101

  ip **bleep** 10.180.4.81

[JackRiley]

Would this ERSPAN solution work from an SDA enabled EN to a non fabric router? For example, an ERSPAN session from an EN at multiple sites, back to a single ERSPAN aggregator connected to a DC switch?

Thanks,

J

[andy!doesnt!like!uucp]

it will assuming there is end-2-end connectivity bw src & dst.

[jedolphi]

The config snip I shared above would, yes. Replace "SDA EN2 - ERSPAN destination" with whatever ERSPAN capable device, including a device that is outside the fabric e.g. a non-SDA C9K switch.

[JackRiley]

Based on the destination not being a destination switch, Am i right in thinking that there is only the source switch configuration to consider in this instance?

As the ERSPAN destination is an appliance, that appliance will simply receive the traffic and the routed network in between will just pass the encapsulated traffic to the device configured as the ERSPAN destination.

Thanks,

J

[andy!doesnt!like!uucp]

it's something i 'm still curios of erspan's destination formula :0)
1) if "destination interface X" is set & attached to it TAP will consume/analyse traffic w/o problem why config need "source/ip **bleep** address"?
2) what is the purpose of "source/ip **bleep** address" at all if analyser IP is already defined in ERSPAN-Source switch?
In real life i've always been using remote wireshar machine w/o any ERSPAN Destination switch

[JackRiley]

I think the source IP is just for the tunnel configuration for GRE on the receiving switch. 

When you setup a typical GRE tunnel you specify the src/dst IP or interface, i imagine under the hood, the ERSPAN session also requires the same information to ensure that the sessions' associated tunnel can establish. I'm not sure if you could in theory use the same session ID on multiple source switches to the same destination switch, which would then need the source IP address of the tunnel as the differentiator.

I'm also curious.

[andy!doesnt!like!uucp]

lets take erspan-id as base here. u may have number of taps with number of src switches (erspan source) pointing to different or the same destination. 
Then u configure on the erspan-src switch:

monitor session X type erspan-source

source interface <variable>

destination

  erspan-id <Constant>

  ip **bleep** <variable>
to have taps to catch traffic of interest. & it will work
Q: why on the tap adjacent switch we need to configure something different from "destination interface X,Y,Z"?
especially

source

  erspan-id <Constant>

  ip **bleep** <something_already_defined_on_the_Erspan_src_switch>
?

[nancyrawls]

Running DNAC 1.3.3.6 and don't have the service.

[markus.forrer]

I think you have to go for a upgrade of your DNAC.

At least DNAC Version 2.2.3.4 brings the following support.

You can configure Switched Port Analyzer (SPAN) and Encapsulated Remote Switched Port Analyzer (ERSPAN) sessions on switches to share IP traffic for application assurance and endpoint analytics.