02-22-2024 12:17 PM
hi everyone,
i want to setup a monitor session over a routed core network using the ERSPAN feature. the ERSPAN Source is a Cat 9500 (IOS 17.3.7) with this configuration
monitor session 55 type erspan-source
source interface Twe1/0/1 , Twe1/0/32
destination
erspan-id 55
mtu 1400
ip address 1.1.1.1
origin ip address 2.2.2.2
the destination is a Cat 9500 (IOS 17.9.5)
with the configuration
monitor session 55 type erspan-destination
shutdown
destination interface Twe1/0/1
source
erspan-id 55
ip address 2.2.2.2
there is no out comming traffic on interface twe1/0/1 and evertime the traffic is getting higher, the destination Cat9500 lost his connection and is no longer available.
is the Cat 9500 able to terminate a ERSPAN Session?
thanks and regards
Nils
02-22-2024 12:23 PM - edited 02-22-2024 12:24 PM
yes that is support ERSPAN, why shutdown command there in the config ?
02-22-2024 12:41 PM
hey @balaji.bandi
thanks for your response, sorry in the "real" config on the switch there is no "shutdown"
02-22-2024 12:44 PM
XXXXX#show monitor session 55
Session 55
----------
Type : ERSPAN Source Session
Status : Admin Enabled
Source Ports :
Both : Twe1/0/1,Twe1/0/32
Destination IP Address : XXXXX
MTU : 9000
Destination ERSPAN ID : 55
Origin IP Address : XXXXX
XXXXX#show monitor session 55
Session 55
----------
Type : ERSPAN Destination Session
Status : Admin Enabled
Destination Ports : Twe1/0/1
Source IP Address : XXXXXXX
Source ERSPAN ID : 55
02-22-2024 12:52 PM
i see both the switch name XXXX ( you know the ERSPAN rule check the guide line
you can not have source and destination same port.
02-22-2024 12:56 PM
@balaji.bandi there a two different switches, XXXX is not the realname of the device and there are two different ports twe 1/0/1 on the first an twe 1/0/1 on the second.... the switches are connected over a routet network. and the MTU size is always higher than 9000.
regards Nils
02-22-2024 02:02 PM
what is connected on these ports ?
Twe1/0/1 , Twe1/0/32
do you see any traffic ?
Try Local span and confirm you see some traffic top span locally before you do ERSPAN
02-22-2024 11:22 PM
i have testet sending the traffic with my pc as the destination of the ERSPAN session and displayed it with wireshark. that works! i think the problem is on the destination switch...
02-23-2024 04:10 PM
other thank IOS XE code both the switches are same. (until there are some bugs around the code)
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide