Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2InfrastructureHard
A network security team needs to monitor traffic traversing a critical server farm for anomalies and potential security threats. The requirement is to capture all ingress and egress traffic for specific VLANs on a core switch without disrupting the normal traffic flow. The captured traffic needs to be sent to an intrusion detection system (IDS) located on a different switch in the same data center. Which monitoring feature should be configured?
- AIPFIX (IP Flow Information Export)
- BRSPAN (Remote SPAN)
- CLocal SPAN
- DERSPAN (Encapsulated Remote SPAN)
Show answer & explanationAnswer & explanation
Correct answer: B. RSPAN (Remote SPAN)
RSPAN (Remote SPAN) allows traffic from source ports or VLANs on one switch to be mirrored to a destination port on a different switch within the same network. This is achieved by dedicating a VLAN as an RSPAN VLAN to carry the mirrored traffic between switches, making it suitable for sending captured traffic to an IDS on another switch.
Why the other options are wrong
- A. IPFIX (NetFlow v10) collects flow statistics, not full packet captures.
- C. Local SPAN mirrors traffic to a destination port on the *same* switch.
- D. ERSPAN encapsulates mirrored traffic in a GRE tunnel, allowing it to be sent across Layer 3 networks, which is not specified as a requirement here.
Remote SPAN (RSPAN)
A Cisco feature that allows traffic from source ports or VLANs on one switch to be mirrored to a destination port on a different switch within the same network, using a dedicated RSPAN VLAN.
- Extends SPAN capabilities across multiple switches.
- Requires a dedicated RSPAN VLAN to transport mirrored traffic.
- Destination port must be on a switch participating in the RSPAN VLAN.
Memory trick: SPAN's Mirrors: Local, Remote, or Encapsulated.