Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2Network AssuranceMedium

An administrator needs to implement Encapsulated Remote SPAN (ERSPAN) to capture traffic from a server connected to a Cisco Catalyst switch in a branch office and send it to a centralized monitoring tool in the data center, across a Layer 3 WAN link. Which of the following is a key characteristic of ERSPAN that enables this functionality?

  1. AIt uses a dedicated RSPAN VLAN for traffic transport.
  2. BIt requires a Layer 2 tunnel protocol like L2TPv3.
  3. CIt encapsulates mirrored traffic in a GRE tunnel.
  4. DIt is limited to mirroring traffic on a single switch.
Show answer & explanation

Correct answer: C. It encapsulates mirrored traffic in a GRE tunnel.

ERSPAN's key characteristic is its ability to encapsulate mirrored traffic within a Generic Routing Encapsulation (GRE) tunnel. This allows the encapsulated traffic to be routed across Layer 3 networks, making it suitable for monitoring traffic over WAN links or between different IP subnets.

Why the other options are wrong

  • A. This describes RSPAN, which is limited to Layer 2 domains.
  • B. While L2TPv3 can tunnel Layer 2 over Layer 3, ERSPAN specifically uses GRE for its encapsulation, not L2TPv3.
  • D. This describes local SPAN, not ERSPAN, which is designed for remote monitoring.

Encapsulated Remote SPAN (ERSPAN)

A Cisco feature that mirrors traffic from source ports or VLANs and encapsulates it into a GRE tunnel, allowing it to be routed across Layer 3 networks to a remote destination.

  • Uses GRE encapsulation.
  • Enables monitoring across Layer 3 boundaries (WAN/Internet).
  • Requires IP routing between source and destination.

Memory trick: SPAN is local, RSPAN is VLAN, ERSPAN is GRE, for the WAN plan.

More Network Assurance questions