Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2InfrastructureHard
A network security team needs to capture traffic from multiple VLANs traversing a core switch and send it to a dedicated analysis server located on a different switch in a different building. The analysis server needs to receive a copy of the traffic from several source ports across these VLANs. Which SPAN feature should be implemented?
- AEncapsulated Remote SPAN (ERSPAN)
- BLocal SPAN (LSPAN)
- CVLAN SPAN (VSPAN)
- DRemote SPAN (RSPAN)
Show answer & explanationAnswer & explanation
Correct answer: A. Encapsulated Remote SPAN (ERSPAN)
Encapsulated Remote SPAN (ERSPAN) is required when the source and destination SPAN sessions are on different switches and potentially separated by Layer 3 devices. ERSPAN encapsulates the monitored traffic in a GRE tunnel, allowing it to be routed across the network to a remote destination.
Why the other options are wrong
- B. Local SPAN only works when the source and destination are on the same switch.
- C. VLAN SPAN is a form of SPAN where an entire VLAN's traffic is monitored, but it doesn't address the 'different switch in a different building' requirement for the destination.
- D. Remote SPAN (RSPAN) works across multiple switches within the same Layer 2 domain (using a special RSPAN VLAN), but not across Layer 3 boundaries or different buildings separated by routers.
Encapsulated Remote SPAN (ERSPAN)
A Cisco feature that allows traffic from source ports or VLANs on one switch to be mirrored and sent to a destination port on another switch, potentially across Layer 3 boundaries, by encapsulating the monitored traffic in a GRE tunnel.
- Mirrors traffic across Layer 3 boundaries.
- Uses GRE encapsulation.
- Source and destination can be anywhere in the IP network.
- Requires IP routing between source and destination.
Memory trick: ERSPAN: Encapsulate and Route to See All.