In this video, we get to focus our attention on the configuration
implementation of verification of ER span.
And the E there represents encapsulation. Again, that's using GRE.
So as far as the game plan for configuring ER span, let's go ahead and use
switch 3 and let's capture data that's coming in or out of its gig 2/0
interface.
Now, I had to get a little bit creative here because my other images for these
switches did not support ER span. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I use some CSR images here and what these are, these are really routers, but
guess what?
The CSR 1000V also supports ER span. So we're going to use the same syntax we
would on a traditional multi-layer switch that supports ER span, but we're
going to do it right here on switch 3, which is really a CSR 1000 router.
So for our game plan, let's go ahead and use session 3 on switch 3 and let's go
ahead and capture the data that's going in or out of gig 2.
So that would be the source, gig 2 inbound or outbound traffic on that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that would be the source, gig 2 inbound or outbound traffic on that
interface.
And this link here between switch 3 and R1 is not a trunk, so there won't be 8
or 1Q encapsulation there.
It's just normal packets and frames going back and forth.
And for an ER span session, it's also going to have or need an ID.
So for the ER span ID, let's just go ahead and use 300, just to uniquely
identify that session.
And for the destination address, let's use the IP address of this little
computer down here.
It's Windows 11 and that would be the destination traffic from the span session
going down to this computer.
So for the destination, we'll put the IP address of this computer, which is 10. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for the destination, we'll put the IP address of this computer, which is 10.
44.0.50.
And that's the client and the computer right there.
And for the source address, this switch 3, it has a source loopback address
that's reachable at 33.33.33.33.
So if we're going to capture that traffic that's being shipped over, the source
address will be 33.33.
Etc. And the destination should be 10.44.
The initial layer for protocol would be 47 GRE.
And then the payload of that would include the contents of the traffic that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then the payload of that would include the contents of the traffic that's
been seen inbound and outbound on the gig 2 interface,
now being delivered down here to client nug.
So with that in mind, let's head over to the lab and let's configure erspan on
switch 3.
So in our topology, we'll be focusing starting off on the configuration here on
switch 3.
So here in the lab environment, we're now down on switch 3 in the bottom of 10
corner.
And we're going to set up erspan to collect data that's been seen on gig 2,
which is inbound or outbound.
And then encapsulate that and ship it down to our Windows 11 client. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then encapsulate that and ship it down to our Windows 11 client.
So before we can figure switch 3, let's go to our client nug that's up in the
upper end corner here.
We'll double click on it to open it up.
I just want to verify that it has the IP address we think it does.
So we'll go to command prompt and we'll type in IP config and sure enough, 10.
44.0.50 is its IP address.
And that'll be the destination for our GRE traffic.
We're going to ship down to it from switch 3.
So let's head back over to switch 3 and to get there, we're going to go to
server 1.
And on server 1, we have our putty sessions and here is the tab for switch 3 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And on server 1, we have our putty sessions and here is the tab for switch 3
right there.
So if we do a show monitor session all, we shouldn't have anything here on
switch 3.
Fantastic.
So we'll go ahead and we'll create one.
We'll type in monitor session.
And this is our third example.
So let's use session 3.
And then for the type, we're going to go ahead and specify this is going to be
an erspan source.
So we'll type in erspan dash source press enter.
And now we're going to put in the details regarding our monitor session for er
span.
So as far as options we have, let's go ahead and start with source. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So as far as options we have, let's go ahead and start with source.
We'll specify the source of what we're going to click the data from.
We'll pipe that in.
And for the source, we're going to specify the keyword interface.
And then let's specify gig.
And we want gigabit and what are our options here 1 through 32.
So let's specify the interface.
The source interface is gig 2 based on our plan.
And then we just peek at our topology and verify that.
So that part looks good right there.
And we'll press enter.
I'm also going to go ahead and make sure that the session is not shut down.
So we'll do a no shut down.
And then we also need to specify where we're going to send this data. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we also need to specify where we're going to send this data.
So we'll type in the destination press enter.
And now it's asking us about the destination information where we're going to
ship off this data to once we encapsulate it.
So here, let's go ahead and specify an erspan ID.
So let's specify erspan.
A little warning about the memory used by this little CSR iOS device.
That's okay.
It's not causing a failure.
So erspan ID and based on our plan, we want to go ahead and use the number of
300.
So press enter and then in particular, look at our other options.
We have the option for specifying the IP address for the destination. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have the option for specifying the IP address for the destination.
So let's type in IP address and for the destination, we're going to have to be
10 dot 44 dot 0 dot 50.
So plug that in.
A little question mark and we'll also specify the origin information.
So let's say origin and sweet the origin IP address that we have specify and
the origin IP address.
It's switch three loopback address of 33 dot 33 dot 33 dot 33.
We'll press enter.
It's also do show IP interface brief.
Just to verify it has that IP address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Just to verify it has that IP address.
It does on loopback zero.
Let's also just do a quick verification with a do ping down to 10 dot 44 dot 0
dot 50.
Does source it from loopback zero.
Just to verify we have connectivity and we do.
That's a great sign.
And then we'll type in exit.
In fact, we go all the way out and let's go ahead and do a show monitor session
.
We're going to go ahead and do a quick verification.
WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to go ahead and do a quick verification.
WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to go ahead and do a quick verification.
WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to go ahead and do a quick verification.
IP Proto Space 47.
That way, Wireshark will only capture traffic that has out layer 4, protocol 47
, which is
GRE, and that will filter out any other traffic from our packet capture that's
not directly
related to the capture to the R-SPAN session.
I'm going to put IP Proto's 47 there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm going to put IP Proto's 47 there.
Then we'll go ahead and double click on the net 1044 to start the capture.
At the moment, I'll check it out.
I have some OSPF Hello messages on that interface.
That'd be this interface right here.
Switch 3's Gig 2 interface.
Let's generate some very specific traffic that we can confirm is coming from PC
12 that's
going down to the loopback on Switch 3.
Let's go back to server 1.
We'll leave the capture running.
Back at server 1, let's go to PC12 and let's do a ping down to 33. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Back at server 1, let's go to PC12 and let's do a ping down to 33.
33.
We'll send 5 of those and there we have it and they're all successful.
Those packets, as they showed up on Gig 2, both the traffic coming in and also
the replies
going back, that traffic should have been encapsulated and shipped over down to
our Windows 11 client,
which should be showing up in our protocol capture.
Let's go back to our client nug machine and it's already open.
I'll go ahead and go down here to the bottom of the taskbar, bring it up.
Then we'll capture that traffic.
Let me go ahead and stop the capture by clicking in the little red box right WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let me go ahead and stop the capture by clicking in the little red box right
there.
Let's take a look together.
If we scroll up, check it out.
Here's our first ping request from 1012.051 going to 33.33, et cetera.
Next packet here, that's the reply from the loopback on switch 3 going back to
our PC.
We did this initial request here.
Let me go ahead and take a look at that specific packet by double clicking on
it and then I'll
expand that and then I'm going to minimize the details here so we have more
room to look
at the actual headers and elements of the GRE and CalPSA traffic.
For the most outside IP header, we have the source of 33.33.33 which is switch WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For the most outside IP header, we have the source of 33.33.33 which is switch
3 setting
the traffic to 1044.050 and at layer 4 it's using GRE.
When we take a look at the innermost payload here, the GRE is carrying.
Then after the GRE header has some details about ER span and then beyond that
we have
the innermost payload which is Ethernet 2.0 that's the original frame, the
source NIST
nation and then we have the IP4 header coming from 1012.051 going to 33, et c
etera.
Then we have the payload which is ICMP and it's a ping request and then the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then we have the payload which is ICMP and it's a ping request and then the
responses
in the next packet where it was responded to.
Then go ahead and close that.
So here in the output of the packet capture is showing the innermost IP address
is involved
sourcing it from 1012.051 which was in the payload of the GRE packet going to
33, 33,
33, 33.
So if we go back to our command line and we go back to switch 3.
So back at switch 3 if we did a show monitor session space question mark and
let's just
type in 3 space question mark and then detail.
It'll give us information about that session.
So it's an ER span source session. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it's an ER span source session.
It's enabled.
The source interface is gig 2 and with the space bar to continue.
The destination IP address to send the encapsulated data is 1044.050 and all
the other parameters
that we specified when we configured it.
Or if we don't want that detail, it usually will show monitor session 3 and
that it will
show us the high level overview of that span session.
So now that we have taken a look at the configuration and verification of span,
our span and now
ER span in the next video, I'd like to give you an opportunity to get hands-on
practice
working with span. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
working with span.
I'll present that hands on the app in the next video and I'll see you there in
just a moment.