ERSPAN on Catalyst 6500

[Steve Fuller]

Hi,

I'm trying to get ERSPAN working with an ERSPAN source on a Nexus 5548 and the ERSPAN destination on a Catalyst 6500.

The configuration on the Nexus is as follows:

[...]

interface loopback0

  ip address 192.168.2.133/32

  ip router eigrp 1

  ip pim sparse-mode

[...]

monitor session 1 type-erspan-source

  erspan-id 11

  vrf default

  destination ip 192.168.15.133

  source interface Ethernet1/31 both

  source interface Ethernet1/32 both

  no shut

monitor erspan origin ip-address 192.168.2.133 global

The configuration on the C6500 is as follows:

[...]

interface GigabitEthernet4/6

switchport

switchport mode access

spanning-tree portfast edge

[...]

monitor session 1 type erspan-destination

destination interface Gi4/6

source

  erspan-id 11

  ip address 192.168.2.133

[...]

If I do a netdr capture I can see ERSPAN traffic sourced from the Nexus reaching the C6500, but there doesn't appear to be anything sent out the ERSPAN destination inerface (Gi4/6) and there's nothing being received by the probe connected to that interface. I know the traffic seen with netdr is definitely the ERSPAN traffic sourced from the Nexus as I've changed the TTL and DSCP values within the monitor session on the Nexus and can see those changes reflected on the C6500 netdr capture. The attached is a screen grab of the show netdr capture started with debug netdr capture soure-ip-address 192.168.2.133.

When I look at the interface I see it shown as up/down (monitoring), but no output or counters clocking up. If I run a local SPAN session on the C6500 it works fine.

I've tried changing the destination IP address from that assigned to the C6500 Loopback interface to an IP address assigned to a physical interface, but that still doens't work.

The hardware in the C6500 is WS-SUP720-BASE Hw version 3.2 with WS-F6K-PFC3B Hw version 2.4. The IOS version is 12.2(33)SXI6.

Am I missing something really obvious here? Any ideas where to look next?

Regards

[branfarm1 · Accepted solution]

Hi Steve,

I was seeing this exact issue between a 5010 and 6500 this week -- I was seeing the traffic leave the Nexus and hit the 6500, but it was never being pushed back out my erspan-destination port. Try changing your erspan config on the 6500 so it is sourcing from the loopback on your 6500:

monitor session 1 type erspan-destination

destination interface Gi4/6

source

  erspan-id 11

  ip address 192.168.15.133

So basically, the erspan-source session on the Nexus is sending the data to the loopback on your 6500, and your monitor session on the 6500 should also be grabbing the data from the Loopback address.

Hope that helps!

[Steve Fuller]

Thanks for the pointer - that's sorted it. I've read so much Cisco documentation and blog posts on ERSPAN in search of this and didn't see this mentioned anywhere.

Regards