Hi all I configured an erspan session running on a Nexus 3k with 2 sources: 1st source is an interface on the same switch 2nd source is a set of vlans which go through a trunk port which already has a span session running Config is as below: monitor session 10 type erspan-source erspan-id 10 vrf default destination ip 10.1.1.1 source interface Ethernet1/18 both source vlan 3-5,10 no shut monitor erspan origin ip-address 10.1.1.100 global In the config above, 10.1.1.1 is the station running tcpdump 10.1.1.100 is the IP of the switch itself To add some complexity to the set up: The 1st source is a switchport that has been sub-divided into 2 sub-interfaces i.e. eth1/1.1 and eth1/1.2 and the capture station's interface is also subdivided into several VLANs The capture has ran for a few days and I am not capturing what I am intending to capture. I am seeing traffic that isn't meant to traverse those 2 sources. Is it due to the fact that the capture is going to a sub-int or because i am using vrf default or a combination? :) Would appreciate it if someone could send some pointers my way.
... View more
I have been trying to figure out this problem for a few days and cannot seem to grasp what is required/missing.
Scenario (please bear with me):
The colors depict the different physical locations of the devices.
We have an existing leased line going from Switch B to Site A's Switch C.
To add resiliency in case we lose connectivity to the orange location, we added a second leased line going from Switch A to Site A's Switch C.
Due to historical reasons, the Firewall (ASA) is doing our layer 3 routing for hosts behind switch A and currently, hosts on Switch A can ping hosts behind Switch C via subnet 10.10.10.0/24 (Vlan3).
For the new leased line, Switch A's new vlan4 interface can ping Switch C's new vlan4 interface which uses 10.10.20.0/24 but hosts on Switch A (who's default gateway points to a sub-interface on the ASA) are not able to ping Switch C's Vlan4 interface.
I understand that the entire set up is far from perfect and we are working towards improvements but can someone provide some insights as to what is required to make this work?
Some things I have tried so far is to create a new sub-int for vlan4 on the ASA and created a static route on the ASA to Switch A's vlan4 interface.
With that, I am able to ping Switch C's vlan4 Interface IP but leased line is still not "usable" as hosts are not able to ping Switch C's vlan4 interface.
Hope it all makes sense.
... View more
Just revisiting this topic.
I have a similar scenario whereby my layer 3 device is an ASA.
I was thinking of moving the inter-vlan routing within my LAN to a stack of 2960x (running k9) image and let the ASA act only as a firewall.
It will not have more than 16 static routes I don't think.
However, one complication I foresee is that we currently have firewall rules applied for some of the VLANs accessing other VLANs. May be a nightmare trying to convert those rules into ACLs on the switch.
Also, the CPU on the current switch stack does run quite high certain times of the day.
Not sure if this should even be attempted.
Any feedback is much appreciated.
... View more