WEBVTT

1
00:00.000 --> 00:03.260
In this video, we get to focus our attention on the configuration

2
00:03.260 --> 00:07.000
implementation of verification of ER span.

3
00:07.000 --> 00:11.000
And the E there represents encapsulation. Again, that's using GRE.

4
00:11.000 --> 00:16.820
So as far as the game plan for configuring ER span, let's go ahead and use

5
00:16.820 --> 00:22.420
switch 3 and let's capture data that's coming in or out of its gig 2/0

6
00:22.420 --> 00:23.000
interface.

7
00:23.000 --> 00:27.860
Now, I had to get a little bit creative here because my other images for these

8
00:27.860 --> 00:30.000
switches did not support ER span.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:30.000 --> 00:34.360
So I use some CSR images here and what these are, these are really routers, but

10
00:34.360 --> 00:35.000
guess what?

11
00:35.000 --> 00:40.280
The CSR 1000V also supports ER span. So we're going to use the same syntax we

12
00:40.280 --> 00:45.260
would on a traditional multi-layer switch that supports ER span, but we're

13
00:45.260 --> 00:49.000
going to do it right here on switch 3, which is really a CSR 1000 router.

14
00:49.000 --> 00:53.470
So for our game plan, let's go ahead and use session 3 on switch 3 and let's go

15
00:53.470 --> 00:56.000
ahead and capture the data that's going in or out of gig 2.

16
00:56.000 --> 01:00.260
So that would be the source, gig 2 inbound or outbound traffic on that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:56.000 --> 01:00.260
So that would be the source, gig 2 inbound or outbound traffic on that

17
01:00.260 --> 01:01.000
interface.

18
01:01.000 --> 01:04.480
And this link here between switch 3 and R1 is not a trunk, so there won't be 8

19
01:04.480 --> 01:06.000
or 1Q encapsulation there.

20
01:06.000 --> 01:09.000
It's just normal packets and frames going back and forth.

21
01:09.000 --> 01:13.000
And for an ER span session, it's also going to have or need an ID.

22
01:13.000 --> 01:17.570
So for the ER span ID, let's just go ahead and use 300, just to uniquely

23
01:17.570 --> 01:19.000
identify that session.

24
01:19.000 --> 01:22.760
And for the destination address, let's use the IP address of this little

25
01:22.760 --> 01:24.000
computer down here.

26
01:24.000 --> 01:27.570
It's Windows 11 and that would be the destination traffic from the span session

27
01:27.570 --> 01:29.000
going down to this computer.

28
01:29.000 --> 01:33.040
So for the destination, we'll put the IP address of this computer, which is 10.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:29.000 --> 01:33.040
So for the destination, we'll put the IP address of this computer, which is 10.

29
01:33.040 --> 01:36.000
44.0.50.

30
01:36.000 --> 01:38.000
And that's the client and the computer right there.

31
01:38.000 --> 01:43.000
And for the source address, this switch 3, it has a source loopback address

32
01:43.000 --> 01:48.000
that's reachable at 33.33.33.33.

33
01:48.000 --> 01:51.510
So if we're going to capture that traffic that's being shipped over, the source

34
01:51.510 --> 01:53.000
address will be 33.33.

35
01:53.000 --> 01:55.000
Etc. And the destination should be 10.44.

36
01:55.000 --> 01:58.000
The initial layer for protocol would be 47 GRE.

37
01:58.000 --> 02:02.420
And then the payload of that would include the contents of the traffic that's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:58.000 --> 02:02.420
And then the payload of that would include the contents of the traffic that's

38
02:02.420 --> 02:05.000
been seen inbound and outbound on the gig 2 interface,

39
02:05.000 --> 02:07.000
now being delivered down here to client nug.

40
02:07.000 --> 02:11.340
So with that in mind, let's head over to the lab and let's configure erspan on

41
02:11.340 --> 02:12.000
switch 3.

42
02:12.000 --> 02:15.350
So in our topology, we'll be focusing starting off on the configuration here on

43
02:15.350 --> 02:16.000
switch 3.

44
02:16.000 --> 02:20.520
So here in the lab environment, we're now down on switch 3 in the bottom of 10

45
02:20.520 --> 02:21.000
corner.

46
02:21.000 --> 02:26.000
And we're going to set up erspan to collect data that's been seen on gig 2,

47
02:26.000 --> 02:27.000
which is inbound or outbound.

48
02:27.000 --> 02:31.000
And then encapsulate that and ship it down to our Windows 11 client.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:27.000 --> 02:31.000
And then encapsulate that and ship it down to our Windows 11 client.

49
02:31.000 --> 02:33.990
So before we can figure switch 3, let's go to our client nug that's up in the

50
02:33.990 --> 02:35.000
upper end corner here.

51
02:35.000 --> 02:37.000
We'll double click on it to open it up.

52
02:37.000 --> 02:40.000
I just want to verify that it has the IP address we think it does.

53
02:40.000 --> 02:45.000
So we'll go to command prompt and we'll type in IP config and sure enough, 10.

54
02:45.000 --> 02:47.000
44.0.50 is its IP address.

55
02:47.000 --> 02:51.000
And that'll be the destination for our GRE traffic.

56
02:51.000 --> 02:53.000
We're going to ship down to it from switch 3.

57
02:53.000 --> 02:56.260
So let's head back over to switch 3 and to get there, we're going to go to

58
02:56.260 --> 02:57.000
server 1.

59
02:57.000 --> 03:01.130
And on server 1, we have our putty sessions and here is the tab for switch 3
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:57.000 --> 03:01.130
And on server 1, we have our putty sessions and here is the tab for switch 3

60
03:01.130 --> 03:02.000
right there.

61
03:02.000 --> 03:06.460
So if we do a show monitor session all, we shouldn't have anything here on

62
03:06.460 --> 03:07.000
switch 3.

63
03:07.000 --> 03:08.000
Fantastic.

64
03:08.000 --> 03:10.000
So we'll go ahead and we'll create one.

65
03:10.000 --> 03:12.000
We'll type in monitor session.

66
03:12.000 --> 03:13.000
And this is our third example.

67
03:13.000 --> 03:14.000
So let's use session 3.

68
03:14.000 --> 03:18.400
And then for the type, we're going to go ahead and specify this is going to be

69
03:18.400 --> 03:20.000
an erspan source.

70
03:20.000 --> 03:24.000
So we'll type in erspan dash source press enter.

71
03:24.000 --> 03:27.730
And now we're going to put in the details regarding our monitor session for er

72
03:27.730 --> 03:28.000
span.

73
03:28.000 --> 03:31.000
So as far as options we have, let's go ahead and start with source.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:28.000 --> 03:31.000
So as far as options we have, let's go ahead and start with source.

74
03:31.000 --> 03:34.000
We'll specify the source of what we're going to click the data from.

75
03:34.000 --> 03:35.000
We'll pipe that in.

76
03:35.000 --> 03:37.000
And for the source, we're going to specify the keyword interface.

77
03:37.000 --> 03:39.000
And then let's specify gig.

78
03:39.000 --> 03:43.000
And we want gigabit and what are our options here 1 through 32.

79
03:43.000 --> 03:44.000
So let's specify the interface.

80
03:44.000 --> 03:47.000
The source interface is gig 2 based on our plan.

81
03:47.000 --> 03:49.000
And then we just peek at our topology and verify that.

82
03:49.000 --> 03:52.000
So that part looks good right there.

83
03:52.000 --> 03:53.000
And we'll press enter.

84
03:53.000 --> 03:57.000
I'm also going to go ahead and make sure that the session is not shut down.

85
03:57.000 --> 03:58.000
So we'll do a no shut down.

86
03:58.000 --> 04:01.000
And then we also need to specify where we're going to send this data.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:58.000 --> 04:01.000
And then we also need to specify where we're going to send this data.

87
04:01.000 --> 04:03.000
So we'll type in the destination press enter.

88
04:03.000 --> 04:07.000
And now it's asking us about the destination information where we're going to

89
04:07.000 --> 04:09.000
ship off this data to once we encapsulate it.

90
04:09.000 --> 04:13.000
So here, let's go ahead and specify an erspan ID.

91
04:13.000 --> 04:15.000
So let's specify erspan.

92
04:15.000 --> 04:19.000
A little warning about the memory used by this little CSR iOS device.

93
04:19.000 --> 04:20.000
That's okay.

94
04:20.000 --> 04:21.000
It's not causing a failure.

95
04:21.000 --> 04:24.710
So erspan ID and based on our plan, we want to go ahead and use the number of

96
04:24.710 --> 04:25.000
300.

97
04:25.000 --> 04:28.000
So press enter and then in particular, look at our other options.

98
04:28.000 --> 04:31.000
We have the option for specifying the IP address for the destination.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
04:28.000 --> 04:31.000
We have the option for specifying the IP address for the destination.

99
04:31.000 --> 04:34.730
So let's type in IP address and for the destination, we're going to have to be

100
04:34.730 --> 04:37.000
10 dot 44 dot 0 dot 50.

101
04:37.000 --> 04:38.000
So plug that in.

102
04:38.000 --> 04:42.000
A little question mark and we'll also specify the origin information.

103
04:42.000 --> 04:46.280
So let's say origin and sweet the origin IP address that we have specify and

104
04:46.280 --> 04:48.000
the origin IP address.

105
04:48.000 --> 04:51.000
It's switch three loopback address of 33 dot 33 dot 33 dot 33.

106
04:51.000 --> 04:56.000
We'll press enter.

107
04:56.000 --> 04:59.000
It's also do show IP interface brief.

108
04:59.000 --> 05:01.000
Just to verify it has that IP address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:59.000 --> 05:01.000
Just to verify it has that IP address.

109
05:01.000 --> 05:03.000
It does on loopback zero.

110
05:03.000 --> 05:07.370
Let's also just do a quick verification with a do ping down to 10 dot 44 dot 0

111
05:07.370 --> 05:09.000
dot 50.

112
05:09.000 --> 05:11.000
Does source it from loopback zero.

113
05:11.000 --> 05:13.000
Just to verify we have connectivity and we do.

114
05:13.000 --> 05:14.000
That's a great sign.

115
05:14.000 --> 05:15.000
And then we'll type in exit.

116
05:15.000 --> 05:19.700
In fact, we go all the way out and let's go ahead and do a show monitor session

117
05:19.700 --> 05:20.000
.

118
05:20.000 --> 05:22.000
We're going to go ahead and do a quick verification.

119
05:22.000 --> 05:24.000
We're going to go ahead and do a quick verification.

120
05:24.000 --> 05:26.000
We're going to go ahead and do a quick verification.

121
05:26.000 --> 05:28.000
We're going to go ahead and do a quick verification.

122
05:28.000 --> 05:30.000
We're going to go ahead and do a quick verification.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:30.000 --> 05:32.000
We're going to go ahead and do a quick verification.

124
05:32.000 --> 05:34.000
We're going to go ahead and do a quick verification.

125
05:34.000 --> 05:36.000
We're going to go ahead and do a quick verification.

126
05:36.000 --> 05:38.000
We're going to go ahead and do a quick verification.

127
05:38.000 --> 05:40.000
We're going to go ahead and do a quick verification.

128
05:40.000 --> 05:42.000
We're going to go ahead and do a quick verification.

129
05:42.000 --> 05:44.000
We're going to go ahead and do a quick verification.

130
05:44.000 --> 05:46.000
We're going to go ahead and do a quick verification.

131
05:46.000 --> 05:48.000
We're going to go ahead and do a quick verification.

132
05:48.000 --> 05:50.000
We're going to go ahead and do a quick verification.

133
05:50.000 --> 05:52.000
We're going to go ahead and do a quick verification.

134
05:52.000 --> 05:54.000
We're going to go ahead and do a quick verification.

135
05:54.000 --> 05:56.000
We're going to go ahead and do a quick verification.

136
05:56.000 --> 05:58.000
We're going to go ahead and do a quick verification.

137
05:58.000 --> 06:00.000
We're going to go ahead and do a quick verification.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
06:00.000 --> 06:02.000
We're going to go ahead and do a quick verification.

139
06:02.000 --> 06:04.000
We're going to go ahead and do a quick verification.

140
06:04.000 --> 06:06.000
We're going to go ahead and do a quick verification.

141
06:06.000 --> 06:08.000
We're going to go ahead and do a quick verification.

142
06:08.000 --> 06:10.000
We're going to go ahead and do a quick verification.

143
06:10.000 --> 06:12.000
We're going to go ahead and do a quick verification.

144
06:12.000 --> 06:14.000
We're going to go ahead and do a quick verification.

145
06:14.000 --> 06:16.000
We're going to go ahead and do a quick verification.

146
06:16.000 --> 06:18.000
We're going to go ahead and do a quick verification.

147
06:18.000 --> 06:20.000
We're going to go ahead and do a quick verification.

148
06:20.000 --> 06:22.000
We're going to go ahead and do a quick verification.

149
06:22.000 --> 06:24.000
We're going to go ahead and do a quick verification.

150
06:24.000 --> 06:26.000
We're going to go ahead and do a quick verification.

151
06:26.000 --> 06:28.000
We're going to go ahead and do a quick verification.

152
06:28.000 --> 06:30.000
We're going to go ahead and do a quick verification.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
06:30.000 --> 06:32.000
We're going to go ahead and do a quick verification.

154
06:32.000 --> 06:34.000
We're going to go ahead and do a quick verification.

155
06:34.000 --> 06:36.000
We're going to go ahead and do a quick verification.

156
06:36.000 --> 06:38.000
We're going to go ahead and do a quick verification.

157
06:38.000 --> 06:40.000
We're going to go ahead and do a quick verification.

158
06:40.000 --> 06:42.000
We're going to go ahead and do a quick verification.

159
06:42.000 --> 06:44.000
We're going to go ahead and do a quick verification.

160
06:44.000 --> 06:47.000
IP Proto Space 47.

161
06:47.000 --> 06:53.000
That way, Wireshark will only capture traffic that has out layer 4, protocol 47

162
06:53.000 --> 06:53.000
, which is

163
06:53.000 --> 06:56.660
GRE, and that will filter out any other traffic from our packet capture that's

164
06:56.660 --> 06:57.000
not directly

165
06:57.000 --> 06:59.000
related to the capture to the R-SPAN session.

166
06:59.000 --> 07:02.000
I'm going to put IP Proto's 47 there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
06:59.000 --> 07:02.000
I'm going to put IP Proto's 47 there.

167
07:02.000 --> 07:06.000
Then we'll go ahead and double click on the net 1044 to start the capture.

168
07:06.000 --> 07:08.000
At the moment, I'll check it out.

169
07:08.000 --> 07:11.000
I have some OSPF Hello messages on that interface.

170
07:11.000 --> 07:12.000
That'd be this interface right here.

171
07:12.000 --> 07:14.000
Switch 3's Gig 2 interface.

172
07:14.000 --> 07:18.440
Let's generate some very specific traffic that we can confirm is coming from PC

173
07:18.440 --> 07:19.600
12 that's

174
07:19.600 --> 07:22.000
going down to the loopback on Switch 3.

175
07:22.000 --> 07:24.000
Let's go back to server 1.

176
07:24.000 --> 07:26.000
We'll leave the capture running.

177
07:26.000 --> 07:32.000
Back at server 1, let's go to PC12 and let's do a ping down to 33.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

177
07:26.000 --> 07:32.000
Back at server 1, let's go to PC12 and let's do a ping down to 33.

178
07:32.000 --> 07:33.000
33.

179
07:33.000 --> 07:34.000
33.

180
07:34.000 --> 07:37.000
We'll send 5 of those and there we have it and they're all successful.

181
07:37.000 --> 07:41.170
Those packets, as they showed up on Gig 2, both the traffic coming in and also

182
07:41.170 --> 07:41.560
the replies

183
07:41.560 --> 07:45.660
going back, that traffic should have been encapsulated and shipped over down to

184
07:45.660 --> 07:47.120
our Windows 11 client,

185
07:47.120 --> 07:49.120
which should be showing up in our protocol capture.

186
07:49.120 --> 07:51.560
Let's go back to our client nug machine and it's already open.

187
07:51.560 --> 07:55.560
I'll go ahead and go down here to the bottom of the taskbar, bring it up.

188
07:55.560 --> 07:56.800
Then we'll capture that traffic.

189
07:56.800 --> 08:00.880
Let me go ahead and stop the capture by clicking in the little red box right
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

189
07:56.800 --> 08:00.880
Let me go ahead and stop the capture by clicking in the little red box right

190
08:00.880 --> 08:01.200
there.

191
08:01.200 --> 08:02.880
Let's take a look together.

192
08:02.880 --> 08:04.600
If we scroll up, check it out.

193
08:04.600 --> 08:10.280
Here's our first ping request from 1012.051 going to 33.33, et cetera.

194
08:10.280 --> 08:14.320
Next packet here, that's the reply from the loopback on switch 3 going back to

195
08:14.320 --> 08:14.920
our PC.

196
08:14.920 --> 08:16.160
We did this initial request here.

197
08:16.160 --> 08:19.600
Let me go ahead and take a look at that specific packet by double clicking on

198
08:19.600 --> 08:20.120
it and then I'll

199
08:20.120 --> 08:23.310
expand that and then I'm going to minimize the details here so we have more

200
08:23.310 --> 08:23.920
room to look

201
08:23.920 --> 08:28.840
at the actual headers and elements of the GRE and CalPSA traffic.

202
08:28.840 --> 08:34.080
For the most outside IP header, we have the source of 33.33.33 which is switch
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

202
08:28.840 --> 08:34.080
For the most outside IP header, we have the source of 33.33.33 which is switch

203
08:34.080 --> 08:34.840
3 setting

204
08:34.840 --> 08:39.880
the traffic to 1044.050 and at layer 4 it's using GRE.

205
08:39.880 --> 08:43.120
When we take a look at the innermost payload here, the GRE is carrying.

206
08:43.120 --> 08:47.330
Then after the GRE header has some details about ER span and then beyond that

207
08:47.330 --> 08:47.800
we have

208
08:47.800 --> 08:52.080
the innermost payload which is Ethernet 2.0 that's the original frame, the

209
08:52.080 --> 08:52.280
source NIST

210
08:52.280 --> 08:57.380
nation and then we have the IP4 header coming from 1012.051 going to 33, et c

211
08:57.380 --> 08:57.880
etera.

212
08:57.880 --> 09:01.040
Then we have the payload which is ICMP and it's a ping request and then the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

212
08:57.880 --> 09:01.040
Then we have the payload which is ICMP and it's a ping request and then the

213
09:01.040 --> 09:01.640
responses

214
09:01.640 --> 09:04.000
in the next packet where it was responded to.

215
09:04.000 --> 09:05.480
Then go ahead and close that.

216
09:05.480 --> 09:09.660
So here in the output of the packet capture is showing the innermost IP address

217
09:09.660 --> 09:10.360
is involved

218
09:10.360 --> 09:14.950
sourcing it from 1012.051 which was in the payload of the GRE packet going to

219
09:14.950 --> 09:16.080
33, 33,

220
09:16.080 --> 09:17.080
33, 33.

221
09:17.080 --> 09:20.280
So if we go back to our command line and we go back to switch 3.

222
09:20.280 --> 09:23.780
So back at switch 3 if we did a show monitor session space question mark and

223
09:23.780 --> 09:24.200
let's just

224
09:24.200 --> 09:26.680
type in 3 space question mark and then detail.

225
09:26.680 --> 09:28.880
It'll give us information about that session.

226
09:28.880 --> 09:30.960
So it's an ER span source session.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

226
09:28.880 --> 09:30.960
So it's an ER span source session.

227
09:30.960 --> 09:31.960
It's enabled.

228
09:31.960 --> 09:35.320
The source interface is gig 2 and with the space bar to continue.

229
09:35.320 --> 09:39.000
The destination IP address to send the encapsulated data is 1044.050 and all

230
09:39.000 --> 09:39.800
the other parameters

231
09:39.800 --> 09:41.160
that we specified when we configured it.

232
09:41.160 --> 09:44.780
Or if we don't want that detail, it usually will show monitor session 3 and

233
09:44.780 --> 09:45.400
that it will

234
09:45.400 --> 09:48.440
show us the high level overview of that span session.

235
09:48.440 --> 09:52.440
So now that we have taken a look at the configuration and verification of span,

236
09:52.440 --> 09:53.320
our span and now

237
09:53.320 --> 09:57.510
ER span in the next video, I'd like to give you an opportunity to get hands-on

238
09:57.510 --> 09:58.120
practice

239
09:58.120 --> 10:00.080
working with span.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

239
09:58.120 --> 10:00.080
working with span.

240
10:00.080 --> 10:03.440
I'll present that hands on the app in the next video and I'll see you there in

241
10:03.440 --> 10:04.240
just a moment.