So now let's talk about SPAN, RSPAN, and ERSPAN configuration and verification. So what are these?
These are tools that we have available on our Catalyst iOS switches that give us the opportunity to capture traffic entering or exiting a switch port.
So when we do this capturing, what can we do? We can copy that captured traffic and then we can send that captured traffic to a particular destination.
And typically connected to that destination is some sort of packet capturing device that is running something like Wireshark.
And we still forward the original traffic normally so that way there it can reach its destination.
So this is a packet capture tool that we have on our device. And some of you may refer to it as port mirroring,
but in the world of Cisco we call it SPAN, RSPAN, and ERSPAN.
So we need to be aware of the differences between them and how to configure each and every single one of them for the certification exam.
So SPAN, Switch Port Analyzer, also known as Local SPAN or Local Switch Port Analyzer.
What is this? It's about capturing traffic coming in or out of an interface on a device, copying it, and sending the copy to another port on the exact same device.
So in this case we could be capturing in or out here, capturing in or out here, but the copy we are sending to the port and it's local to the device.
So all sources and all destinations are on the same device.
So the source traffic that is captured can be ingress traffic or egress traffic, so traffic coming in an interface or leaving an interface.
And you can do it on multiple ports. So it doesn't have to be one port at a time. You can capture on many ports.
You can capture for an entire VLAN. You can capture for a trunk link. You can capture for just a single access port or multiple access ports.
So the source can be a multitude of sources. The only thing you have to remember is that you can't mix things like VLANs and ports.
So my source would either have to be ports or my source would have to be VLANs. I can't mix the two of them together.
The destination would be a port connected to a device like we see here with packet capturing software like Wireshark.
The interface is going to be up down and the status is going to be listed as monitored in the output of show interface status.
And I'll show that here to you momentarily.
All right, so here's a configuration example. Whenever you're configuring span, you're going to use the command monitor followed by the word session.
Now, you specify a number, and the number here is just so that way you can have a multitude of sessions running on the actual device.
So in this case, I used monitor session number 1. I could also have 2, 3, 4, 5, 6, 7, 8, et cetera, et cetera.
And the key here is to match up the numbers when you're doing your source destination.
So you'll see here that we use number 1 for both the source and the destination, and that is what tells the device that they go together.
So in this case, I did monitor session 1, source interface, gigabit Ethernet 1 size 0 slash 2.
So this interface right here, and we said both. So you could do both, meaning both inbound and outbound traffic, or you could do RX for only inbound traffic or TX for only outbound traffic.
So if you just want inbound traffic, RX, outbound traffic, TX, if you want both, which is the default, both, then you can type in both or just leave it blank and it'll be both.
Now, if there's another interface you wanted to do, you can actually specify a range of interfaces in there, or you can add another source.
You can add monitor session 1, source interface, gigabit Ethernet 1 size 0 slash 3, monitor session 1, source interface, gigabit Ethernet 1 size 0 slash 4.
So you can do like a range of interfaces, or you could do different interfaces on different lines, and it really depends on the version of iOS that you have that'll determine what type of flexibility you have with the configuration.
And in our destination, you can see monitor session 1 destination interface gig 101. That'll be this interface right here.
So capture traffic inbound and outbound on this interface, make a copy of it, and send it to this particular interface where we are going to have a packet capturing device connected.
So I'm just going to quickly do a config like that here on ASW1.
So interface, oops, interface, monitor session 1 source gigabit Ethernet 1 size 0 slash 2.
And then as you can see, don't need source there.
Monitor session 1 source interface. There we go.
And if we go to the end, hit question mark now, you'll see we got both received transmit, or we can do a range of interfaces at that point in time.
If I wanted to add another one, I could add, for example, another one and another one.
But I would not be able to add a VLAN.
So monitor session 1 source VLAN, let's say let's do VLAN 421.
Right, I can't do that because I cannot have both VLANs and interfaces in the exact same monitoring session.
Now, if I type in do show monitor, monitor session number 1, right, you'll see right now we have just our source specified.
We don't have our destination specified.
So let me type in do show interface status because I want to show you right now my interface is connected.
But once we turn it into a destination, it's going to stay monitored.
So we'll type in monitor session number 1.
We're going to say destination interfaces gigabit 1 size 0 slash 1.
And let's go ahead and let that cook for just a moment.
We'll type in do show interface status.
You'll now see it says monitoring.
And let's check the output on this device.
Do show IP interface brief.
Let's see what it shows up as in our output here.
All right, yeah, up down.
There you go, up down.
So there's an example there.
So now do show monitor session 1.
You can see that we have our source ports as gigabit 1 size 0 slash 2, 3, 4 in our example.
And then the destination port is going to be gig 1, 0, 1.
And it says local session for local span, local span.
All right, here's some other examples we have in the slide deck to go over.
We have one that is showing VLANs.
So monitor session 2, source VLAN 10.
It says both.
So both traffic incoming and outgoing for VLAN 10.
And then monitor session 2, source VLAN 12, 14.
And receive means only on those interfaces that are part of VLAN 10, 13, and 14 when traffic's coming in.
So it may seem strange.
Well, for a VLAN, what do you mean both?
Well, any interfaces that are part of that VLAN, both would mean both directions on that interface,
whereas with VLAN 12, 13, 14, it would be only receiving on any of those interfaces that are part of those VLANs.
And then my destination is going to be what?
Interface gigabit 1 slash 1, again, in this particular example.
Also, if you want to do, for example, like a trunk port, in this case, a trunk port would be carrying traffic for multiple VLANs.
So in this particular case, what if you don't want to collect all traffic for all VLANs, though, on that trunk port?
Well, you'll see here in this example what I did is I put in both interface 45 and 46.
But look at this filter down here.
Filter VLAN 10.
That means I only want VLAN 10.
I only want VLAN 10 on those interfaces.
That's it.
So VLAN 20, 30, 40, 50, whatever other VLANs we have, that is not going to be captured, just VLAN 10 traffic.
So could I have like 10, 20, 30?
Yes, right?
You could add more VLANs for your filter list if you want to.
But in this case, I'm saying, hey, only that VLAN on those interfaces.
So that's what the filter would be used for in that case.
All right, and there's an example of a local session setup, the one we just did.
So these would be my interfaces, only VLAN 10, and this is the destination we're going to.
All right, so that is SPAN, source and destination on the exact same device.
So our SPAN is about having your source and destination on different devices.
So in this case, we have a tool for capturing traffic and sending a copy of that traffic to another port on a different device across a Layer 2 link.
So, for example, our trunks.
Could be access ports we're going to cross, but typically going to be trunks between them.
So now this is called RSPAN for remote SPAN, remote switch port analyzer.
So in this case, the source is traffic captured, ingress or egress on multiple ports or access ports, trunks, or an entire VLAN like we talked about before.
So the same rules apply as SPAN.
And the destination is going to be some port connected to our switch with a device running software that captures packets like Wireshark.
The interface is going to be up down.
The status listed is going to be monitored just like SPAN.
So all that's going to be the exact same.
But the difference here now is that we have a very, very special VLAN.
It's called the remote SPAN VLAN.
So you're going to create a VLAN like we have here, VLAN 500.
And then under the VLAN configuration mode, you type in remote SPAN.
And that's going to dedicate that VLAN as a remote switch port analyzer VLAN used to carry that captured traffic for you between the source and the destination.
And so down here, you'll see that we typed in monitor session one, source gig one slash one on this device.
But notice what our destination is.
It's remote VLAN 500.
Remote VLAN 500.
So that way there, it can be carried across our chunk link.
So is our chunk link going to need VLAN 500 allowed on it?
Yes, in this particular example, of course.
Absolutely.
Also, something I didn't mention is that you can only have one destination, whether it's SPAN or RSPAN, only one destination.
So in this case here, if I created another destination, it would overwrite this one.
That's what happens.
It doesn't even warn you.
It just overwrites it.
Same thing with SPAN.
If you created another destination, it would just overwrite it.
It doesn't warn you.
It just overwrites what's already there.
So be mindful of that.
Also, another thing is, is what if you accidentally or unpurposely set up your VLAN as a remote SPAN VLAN, but you had access ports in that VLAN?
What did that happen?
So here's an example I put together for you.
In this case, what I did is I went to my device and I said, hey, VLAN 421 is remote SPAN.
The thing is, is I have these two ports as access ports in that VLAN right now.
What happens if I accidentally take my VLAN that has access ports in it and turn it into a remote SPAN VLAN?
The ports go inactive.
Look at that.
The ports go inactive because I turned their VLAN into an R-SPAN VLAN.
Something to keep in mind.
All right.
Now when we look at this here, I have to make sure that all my switches know that VLAN, and they have to know that it's a remote SPAN VLAN.
Or else how are we going to pass traffic from somebody like ASW2 over to DSW2 over to DSW1 and then over to ASW1 where my destination is going to be?
So all the switches have to know that it's the VLAN number, and they have to know that it's the remote SPAN VLAN.
So we do that on ASW1 as well, remote SPAN.
And look at this.
Look at the source.
The source is going to be remote VLAN 500.
If you forget the keyword of remote, what happens?
Well, that creates a SPAN session, not an R-SPAN session, and that would mess everything up for you.
You need the remote keyword.
If the remote keyword is not there, then it's a SPAN session.
That would be no different than doing something like this.
No different.
So with that in mind, right, make sure you don't forget that remote keyword.
Pay attention to that.
And then the VLAN is what is that remote SPAN VLAN where traffic is coming in, that copy traffic.
And then where are we going to send it to?
Monitor session 5, destination, interface gig 11.
So if you're wondering if the session number has to match between the source and destination, well, on the device here it does.
But if you're going to compare it to, for example, like ASW-2, no.
So we go to ASW-2, you'll see we're using session 1 and ASW-2, and I'm using session 5 on ASW-1.
That's fine because that number is locally significant to the device.
And here's another.
Here's some output.
When you look at the output of show monitor, you'll see that it says remote, remote source session.
That's how you know it's R-SPAN.
So the source is either a VLAN or an interface or multiple VLANs or multiple interfaces,
and the destination is the R-SPAN VLAN because it says remote.
The remote destination session, the source would be the remote SPAN VLAN, and the destination would be your destination port.
So if you're looking at R-SPAN output and it says local session, okay, then that means you configured it wrong.
That means you forgot to put the keyword of what?
Source, VLAN?
Destination, VLAN?
So remote, right?
What was it?
Remote VLAN.
That was the difference.
So here's another example of using an interface, setting a filter, so that way we only capture VLAN 50 traffic on that interface,
and then we got our destination, which is the remote SPAN VLAN.
So that's R-SPAN.
Now, when you think about SPAN and R-SPAN, SPAN, we capture traffic on one interface on a switch
and send it to a destination interface on the same switch.
R-SPAN, one switch to the destination, different switch, but within that Layer 2 environment.
Let's be clear here.
It was within that Layer 2 environment.
We did not leave that environment.
We did not leave and go out into the core of the network.
We stayed in this little environment here.
So how in the world would I send my traffic to maybe a centralized monitoring or capturing solution that we have,
let's say in a server farm, a data center we have?
That's where E-R-SPAN comes into play.
E-R-SPAN gives me the opportunity now to capture traffic on my devices,
but send the copy of that captured traffic to another port on the same subnet
or a different subnet across Layer 3 boundaries.
So you'll see here that we have the traffic being captured on one device,
but the other device, the destination device, is in a completely different subnet,
completely different VLAN, completely different broadcast domain across a Layer 3 routed network.
That's what E-R-SPAN does for us.
And notice it's creating a type of GRE tunnel for us.
So we can encapsulate the traffic and send it from one device to the other device across that Layer 3 network.
So this is called encapsulated.
Encapsulated remote SPAN.
So encapsulated remote switch port analyzer is what we call it using GRE.
So what happens here?
We have our source session.
We have a routable E-R-SPAN GRE encapsulated tunnel for our traffic,
and then we have our E-R-SPAN destination.
So traffic can be captured ingress or egress on ports or VLANs.
Same as SPAN and R-SPAN.
You can't mix VLANs and ports, though, like we said.
Captured traffic is sent out a Layer 3 GRE tunnel interface to another device,
and then the receiving device collects that captured traffic
and sends out the port connected to the packet capturing device.
And it's not supported on Layer 2 switching interfaces.
We're dealing with routing interfaces here.
So this supported product list is not up to date, folks,
but you're not going to have to know which devices support E-R-SPAN.
What I want you to realize is that it's not supported on all platforms,
all products, or all versions of iOS.
So check your documentation to find out if your device is supported.
Now, you are going to have to know the config for a certification exam.
So what we have to do is we have to set up our source session here.
We have to set up our destination session here.
But the construct can get a little confusing,
so bear with me here as we go through this and take your time with me.
I'm typing in monitor session 1 type E-R-SPAN source.
E-R-SPAN source.
This is the source device.
So I'm typing in E-R-SPAN source.
This device is going to have a different command we use.
So we're going to get to that later.
Why?
Because it's the destination.
This is the source.
All right.
Now, in the config, you're going to see the prompt change to monitor E-R-SPAN source.
So what we're going to configure now is the source interfaces
or source VLANs for capturing.
So, for example, source interface gig 1-1-2-3 receive.
We can set up a filter here as well.
So on those interfaces, I only want to receive traffic from maybe a certain VLAN,
a certain list, a certain network.
We can do that as well by using your filter VLAN command like we did SPAN and E-R-SPAN.
Sorry, SPAN and R-SPAN.
I think I said E-R-SPAN, so SPAN and R-SPAN.
All right.
Or if you just want to capture traffic for a source VLAN,
you go right in and type in source VLAN 10 or source VLAN 20 or source VLAN 30
or source VLAN 11, 12, 13, whatever you want to capture that for.
All right.
So now that we've defined what sources for capturing, we have to specify our destination.
And what is our destination?
Where we're sending the captured traffic to.
So remember, we're sending the captured traffic out a GRE tunnel.
And so this is how we configure that.
Now, this is totally different than the GRE tunnel configuration you would have learned
previously or earlier in the Encore course.
So under the configuration mode, we just type in destination.
You're going to see how it changes the source destination now.
This is important that you grasp this configuration and the flow of the configuration.
So in the source section, we're specifying what ports we're capturing on,
which VLANs we're capturing on.
And then you type in destination, and that brings you into the destination config.
So it says source destination.
The source is destination configuration.
That's what it means.
Now, what we need to do is we need to create an ear span ID for the tunnel.
So this is just something that you can come up with, right?
So you type in your ear span ID.
The thing is it has to match on both devices.
If it doesn't match on both devices, it's not going to work for you.
So it's got to match on both devices.
Now we need to specify an IP address, and we need to specify an origin IP address.
What's the difference between the two?
It's very simple, and I really encourage you to make sure you know the difference between the two.
It is source of tunnel, destination of tunnel.
That's what that is.
So IP address is the destination IP address of the tunnel.
Origin IP address is the source of the GRE tunnel.
And then you got to make sure you enable it with the no shutdown command.
If it's missing, it's not going to work.
Okay.
So you're not actually going to be having to create a tunnel interface yourself
or set up the GRE information other than what you see here.
This does it all for you.
Another filtering option you have up in the source that I want to mention that just came to my head was an ACL.
So you could actually create an ACL if you wanted to.
So, for example, let's say you created an access list.
Let's say access list one, permit, x.x.x.x.
So what did we just?
We just specified what?
We just specified a source range.
So capture traffic for a specific source IP addressing range.
And then you could specify the command.
What is it?
Filter access group under the source.
So filter access hyphen group and then the number.
So access list one.
So one, one.
And then that would ensure that you only capture the traffic for that particular source.
So if you wanted to specify a source subnet or a subset of that source subnet or multiple subnets, right,
you can get creative with your ACL address and wildcard mask combination to get the exact results that you want.
Now let's talk about the destination device.
So the destination device, we have our monitor session one type.
Look at that.
ER span destination.
So the other one was ER span source.
This one is ER span destination.
So then in the top config here under destination, we configure the destination interface.
So that's this interface here that has the Wireshark device connected to it.
Then you have to specify the source of the GRE tunnel.
So source of GRE tunnel.
So there's that.
You've got to match the ER span ID from the other device.
Then you have to specify the incoming IP address of the device.
Notice how you don't have to specify the IP address of the source here because you have the ER span ID.
So it says if traffic arrives on this interface and it's got this information, the ER span ID 101,
then that is the traffic that is going to be taken from that source and sent to our destination.
So the destination device is the destination config first, the source config second.
On this device, it's source config first, destination config second.
So in this case, what is the source?
The source is any traffic coming into this interface with an ER span ID of 101.
I'm going to take that.
I'm going to send it to that interface.
And that's the config.
You must know this config.
So span, R span, ER span.
Review this a few times to make sure you're comfortable with what I've presented to you about these three different solutions.
Thank you.