Question

A network engineer is configuring ERSPAN on a Catalyst switch to send a copy of traffic from GigabitEthernet1/0/10 to a monitoring appliance located across a routed Layer 3 network at IP address 10.50.50.100. The engineer has entered the following on the source switch:

monitor session 1 type erspan-source
 source interface Gi1/0/10
 destination
  erspan-id 100
  ip address 10.50.50.100

After committing the configuration, no traffic is arriving at the monitoring appliance. Which additional configuration step under the destination sub-mode is required for the ERSPAN session to become operational?

Accepted Answer

Configure the 'origin ip address' with a local routable source IP for the GRE-encapsulated ERSPAN packets

Answer

Configure a 'filter vlan' statement to restrict which VLANs are captured on the source interface

Answer

Change the session type to 'erspan-destination' so the switch can forward the mirrored frames

Answer

Add a 'source remote ip address 10.50.50.100' command so the switch learns the appliance route