Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2Network AssuranceMedium
An administrator needs to implement Encapsulated Remote SPAN (ERSPAN) to capture traffic from a server connected to a Cisco Catalyst switch in a branch office and send it to a centralized monitoring tool in the data center, across a Layer 3 WAN link. Which of the following is a key characteristic of ERSPAN that enables this functionality?
- AIt uses a dedicated RSPAN VLAN for traffic transport.
- BIt requires a Layer 2 tunnel protocol like L2TPv3.
- CIt encapsulates mirrored traffic in a GRE tunnel.
- DIt is limited to mirroring traffic on a single switch.
Show answer & explanationAnswer & explanation
Correct answer: C. It encapsulates mirrored traffic in a GRE tunnel.
ERSPAN's key characteristic is its ability to encapsulate mirrored traffic within a Generic Routing Encapsulation (GRE) tunnel. This allows the encapsulated traffic to be routed across Layer 3 networks, making it suitable for monitoring traffic over WAN links or between different IP subnets.
Why the other options are wrong
- A. This describes RSPAN, which is limited to Layer 2 domains.
- B. While L2TPv3 can tunnel Layer 2 over Layer 3, ERSPAN specifically uses GRE for its encapsulation, not L2TPv3.
- D. This describes local SPAN, not ERSPAN, which is designed for remote monitoring.
Encapsulated Remote SPAN (ERSPAN)
A Cisco feature that mirrors traffic from source ports or VLANs and encapsulates it into a GRE tunnel, allowing it to be routed across Layer 3 networks to a remote destination.
- Uses GRE encapsulation.
- Enables monitoring across Layer 3 boundaries (WAN/Internet).
- Requires IP routing between source and destination.
Memory trick: SPAN is local, RSPAN is VLAN, ERSPAN is GRE, for the WAN plan.