WEBVTT 00:00:00.000 --> 00:00:12.000 So now let's talk about SPAN, RSPAN, and ERSPAN configuration and verification. So what are these? 00:00:12.000 --> 00:00:26.000 These are tools that we have available on our Catalyst iOS switches that give us the opportunity to capture traffic entering or exiting a switch port. 00:00:26.000 --> 00:00:36.000 So when we do this capturing, what can we do? We can copy that captured traffic and then we can send that captured traffic to a particular destination. 00:00:36.000 --> 00:00:44.000 And typically connected to that destination is some sort of packet capturing device that is running something like Wireshark. 00:00:44.000 --> 00:00:50.000 And we still forward the original traffic normally so that way there it can reach its destination. 00:00:50.000 --> 00:00:56.000 So this is a packet capture tool that we have on our device. And some of you may refer to it as port mirroring, 00:00:56.000 --> 00:01:00.000 but in the world of Cisco we call it SPAN, RSPAN, and ERSPAN. 00:01:00.000 --> 00:01:07.000 So we need to be aware of the differences between them and how to configure each and every single one of them for the certification exam. 00:01:07.000 --> 00:01:16.000 So SPAN, Switch Port Analyzer, also known as Local SPAN or Local Switch Port Analyzer. 00:01:16.000 --> 00:01:31.000 What is this? It's about capturing traffic coming in or out of an interface on a device, copying it, and sending the copy to another port on the exact same device. 00:01:31.000 --> 00:01:41.000 So in this case we could be capturing in or out here, capturing in or out here, but the copy we are sending to the port and it's local to the device. 00:01:41.000 --> 00:01:47.000 So all sources and all destinations are on the same device. 00:01:47.000 --> 00:01:57.000 So the source traffic that is captured can be ingress traffic or egress traffic, so traffic coming in an interface or leaving an interface. 00:01:57.000 --> 00:02:04.000 And you can do it on multiple ports. So it doesn't have to be one port at a time. You can capture on many ports. 00:02:04.000 --> 00:02:14.000 You can capture for an entire VLAN. You can capture for a trunk link. You can capture for just a single access port or multiple access ports. 00:02:14.000 --> 00:02:22.000 So the source can be a multitude of sources. The only thing you have to remember is that you can't mix things like VLANs and ports. 00:02:22.000 --> 00:02:28.000 So my source would either have to be ports or my source would have to be VLANs. I can't mix the two of them together. 00:02:28.000 --> 00:02:35.000 The destination would be a port connected to a device like we see here with packet capturing software like Wireshark. 00:02:35.000 --> 00:02:42.000 The interface is going to be up down and the status is going to be listed as monitored in the output of show interface status. 00:02:42.000 --> 00:02:45.000 And I'll show that here to you momentarily. 00:02:45.000 --> 00:02:58.000 All right, so here's a configuration example. Whenever you're configuring span, you're going to use the command monitor followed by the word session. 00:02:58.000 --> 00:03:07.000 Now, you specify a number, and the number here is just so that way you can have a multitude of sessions running on the actual device. 00:03:07.000 --> 00:03:14.000 So in this case, I used monitor session number 1. I could also have 2, 3, 4, 5, 6, 7, 8, et cetera, et cetera. 00:03:14.000 --> 00:03:18.000 And the key here is to match up the numbers when you're doing your source destination. 00:03:18.000 --> 00:03:26.000 So you'll see here that we use number 1 for both the source and the destination, and that is what tells the device that they go together. 00:03:26.000 --> 00:03:31.000 So in this case, I did monitor session 1, source interface, gigabit Ethernet 1 size 0 slash 2. 00:03:31.000 --> 00:03:46.000 So this interface right here, and we said both. So you could do both, meaning both inbound and outbound traffic, or you could do RX for only inbound traffic or TX for only outbound traffic. 00:03:46.000 --> 00:03:56.000 So if you just want inbound traffic, RX, outbound traffic, TX, if you want both, which is the default, both, then you can type in both or just leave it blank and it'll be both. 00:03:56.000 --> 00:04:02.000 Now, if there's another interface you wanted to do, you can actually specify a range of interfaces in there, or you can add another source. 00:04:02.000 --> 00:04:09.000 You can add monitor session 1, source interface, gigabit Ethernet 1 size 0 slash 3, monitor session 1, source interface, gigabit Ethernet 1 size 0 slash 4. 00:04:09.000 --> 00:04:18.000 So you can do like a range of interfaces, or you could do different interfaces on different lines, and it really depends on the version of iOS that you have that'll determine what type of flexibility you have with the configuration. 00:04:19.000 --> 00:04:25.000 And in our destination, you can see monitor session 1 destination interface gig 101. That'll be this interface right here. 00:04:25.000 --> 00:04:37.000 So capture traffic inbound and outbound on this interface, make a copy of it, and send it to this particular interface where we are going to have a packet capturing device connected. 00:04:37.000 --> 00:04:41.000 So I'm just going to quickly do a config like that here on ASW1. 00:04:41.000 --> 00:04:52.000 So interface, oops, interface, monitor session 1 source gigabit Ethernet 1 size 0 slash 2. 00:04:52.000 --> 00:04:58.000 And then as you can see, don't need source there. 00:04:58.000 --> 00:05:02.000 Monitor session 1 source interface. There we go. 00:05:03.000 --> 00:05:10.000 And if we go to the end, hit question mark now, you'll see we got both received transmit, or we can do a range of interfaces at that point in time. 00:05:10.000 --> 00:05:16.000 If I wanted to add another one, I could add, for example, another one and another one. 00:05:16.000 --> 00:05:18.000 But I would not be able to add a VLAN. 00:05:18.000 --> 00:05:24.000 So monitor session 1 source VLAN, let's say let's do VLAN 421. 00:05:24.000 --> 00:05:35.000 Right, I can't do that because I cannot have both VLANs and interfaces in the exact same monitoring session. 00:05:35.000 --> 00:05:44.000 Now, if I type in do show monitor, monitor session number 1, right, you'll see right now we have just our source specified. 00:05:44.000 --> 00:05:46.000 We don't have our destination specified. 00:05:46.000 --> 00:05:52.000 So let me type in do show interface status because I want to show you right now my interface is connected. 00:05:52.000 --> 00:05:55.000 But once we turn it into a destination, it's going to stay monitored. 00:05:55.000 --> 00:05:59.000 So we'll type in monitor session number 1. 00:05:59.000 --> 00:06:04.000 We're going to say destination interfaces gigabit 1 size 0 slash 1. 00:06:04.000 --> 00:06:06.000 And let's go ahead and let that cook for just a moment. 00:06:06.000 --> 00:06:08.000 We'll type in do show interface status. 00:06:08.000 --> 00:06:10.000 You'll now see it says monitoring. 00:06:10.000 --> 00:06:12.000 And let's check the output on this device. 00:06:12.000 --> 00:06:15.000 Do show IP interface brief. 00:06:16.000 --> 00:06:22.000 Let's see what it shows up as in our output here. 00:06:22.000 --> 00:06:23.000 All right, yeah, up down. 00:06:23.000 --> 00:06:30.000 There you go, up down. 00:06:30.000 --> 00:06:31.000 So there's an example there. 00:06:31.000 --> 00:06:35.000 So now do show monitor session 1. 00:06:35.000 --> 00:06:41.000 You can see that we have our source ports as gigabit 1 size 0 slash 2, 3, 4 in our example. 00:06:41.000 --> 00:06:44.000 And then the destination port is going to be gig 1, 0, 1. 00:06:44.000 --> 00:06:49.000 And it says local session for local span, local span. 00:06:49.000 --> 00:06:54.000 All right, here's some other examples we have in the slide deck to go over. 00:06:54.000 --> 00:06:57.000 We have one that is showing VLANs. 00:06:57.000 --> 00:07:01.000 So monitor session 2, source VLAN 10. 00:07:01.000 --> 00:07:02.000 It says both. 00:07:02.000 --> 00:07:06.000 So both traffic incoming and outgoing for VLAN 10. 00:07:06.000 --> 00:07:10.000 And then monitor session 2, source VLAN 12, 14. 00:07:10.000 --> 00:07:19.000 And receive means only on those interfaces that are part of VLAN 10, 13, and 14 when traffic's coming in. 00:07:19.000 --> 00:07:20.000 So it may seem strange. 00:07:20.000 --> 00:07:21.000 Well, for a VLAN, what do you mean both? 00:07:21.000 --> 00:07:27.000 Well, any interfaces that are part of that VLAN, both would mean both directions on that interface, 00:07:27.000 --> 00:07:33.000 whereas with VLAN 12, 13, 14, it would be only receiving on any of those interfaces that are part of those VLANs. 00:07:33.000 --> 00:07:35.000 And then my destination is going to be what? 00:07:35.000 --> 00:07:39.000 Interface gigabit 1 slash 1, again, in this particular example. 00:07:39.000 --> 00:07:47.000 Also, if you want to do, for example, like a trunk port, in this case, a trunk port would be carrying traffic for multiple VLANs. 00:07:47.000 --> 00:07:53.000 So in this particular case, what if you don't want to collect all traffic for all VLANs, though, on that trunk port? 00:07:53.000 --> 00:07:59.000 Well, you'll see here in this example what I did is I put in both interface 45 and 46. 00:07:59.000 --> 00:08:01.000 But look at this filter down here. 00:08:01.000 --> 00:08:02.000 Filter VLAN 10. 00:08:02.000 --> 00:08:05.000 That means I only want VLAN 10. 00:08:05.000 --> 00:08:08.000 I only want VLAN 10 on those interfaces. 00:08:08.000 --> 00:08:09.000 That's it. 00:08:09.000 --> 00:08:16.000 So VLAN 20, 30, 40, 50, whatever other VLANs we have, that is not going to be captured, just VLAN 10 traffic. 00:08:16.000 --> 00:08:18.000 So could I have like 10, 20, 30? 00:08:18.000 --> 00:08:19.000 Yes, right? 00:08:19.000 --> 00:08:22.000 You could add more VLANs for your filter list if you want to. 00:08:22.000 --> 00:08:26.000 But in this case, I'm saying, hey, only that VLAN on those interfaces. 00:08:26.000 --> 00:08:32.000 So that's what the filter would be used for in that case. 00:08:32.000 --> 00:08:36.000 All right, and there's an example of a local session setup, the one we just did. 00:08:36.000 --> 00:08:45.000 So these would be my interfaces, only VLAN 10, and this is the destination we're going to. 00:08:45.000 --> 00:08:50.000 All right, so that is SPAN, source and destination on the exact same device. 00:08:50.000 --> 00:08:54.000 So our SPAN is about having your source and destination on different devices. 00:08:54.000 --> 00:09:02.000 So in this case, we have a tool for capturing traffic and sending a copy of that traffic to another port on a different device across a Layer 2 link. 00:09:02.000 --> 00:09:04.000 So, for example, our trunks. 00:09:04.000 --> 00:09:08.000 Could be access ports we're going to cross, but typically going to be trunks between them. 00:09:08.000 --> 00:09:16.000 So now this is called RSPAN for remote SPAN, remote switch port analyzer. 00:09:16.000 --> 00:09:24.000 So in this case, the source is traffic captured, ingress or egress on multiple ports or access ports, trunks, or an entire VLAN like we talked about before. 00:09:24.000 --> 00:09:26.000 So the same rules apply as SPAN. 00:09:26.000 --> 00:09:36.000 And the destination is going to be some port connected to our switch with a device running software that captures packets like Wireshark. 00:09:36.000 --> 00:09:37.000 The interface is going to be up down. 00:09:37.000 --> 00:09:39.000 The status listed is going to be monitored just like SPAN. 00:09:39.000 --> 00:09:41.000 So all that's going to be the exact same. 00:09:41.000 --> 00:09:46.000 But the difference here now is that we have a very, very special VLAN. 00:09:46.000 --> 00:09:48.000 It's called the remote SPAN VLAN. 00:09:48.000 --> 00:09:51.000 So you're going to create a VLAN like we have here, VLAN 500. 00:09:51.000 --> 00:09:54.000 And then under the VLAN configuration mode, you type in remote SPAN. 00:09:54.000 --> 00:10:07.000 And that's going to dedicate that VLAN as a remote switch port analyzer VLAN used to carry that captured traffic for you between the source and the destination. 00:10:07.000 --> 00:10:13.000 And so down here, you'll see that we typed in monitor session one, source gig one slash one on this device. 00:10:13.000 --> 00:10:15.000 But notice what our destination is. 00:10:15.000 --> 00:10:18.000 It's remote VLAN 500. 00:10:18.000 --> 00:10:27.000 Remote VLAN 500. 00:10:27.000 --> 00:10:30.000 So that way there, it can be carried across our chunk link. 00:10:30.000 --> 00:10:33.000 So is our chunk link going to need VLAN 500 allowed on it? 00:10:33.000 --> 00:10:36.000 Yes, in this particular example, of course. 00:10:36.000 --> 00:10:39.000 Absolutely. 00:10:39.000 --> 00:10:47.000 Also, something I didn't mention is that you can only have one destination, whether it's SPAN or RSPAN, only one destination. 00:10:47.000 --> 00:10:52.000 So in this case here, if I created another destination, it would overwrite this one. 00:10:52.000 --> 00:10:53.000 That's what happens. 00:10:53.000 --> 00:10:54.000 It doesn't even warn you. 00:10:54.000 --> 00:10:55.000 It just overwrites it. 00:10:55.000 --> 00:10:56.000 Same thing with SPAN. 00:10:56.000 --> 00:10:58.000 If you created another destination, it would just overwrite it. 00:10:58.000 --> 00:10:59.000 It doesn't warn you. 00:10:59.000 --> 00:11:00.000 It just overwrites what's already there. 00:11:00.000 --> 00:11:03.000 So be mindful of that. 00:11:03.000 --> 00:11:12.000 Also, another thing is, is what if you accidentally or unpurposely set up your VLAN as a remote SPAN VLAN, but you had access ports in that VLAN? 00:11:12.000 --> 00:11:13.000 What did that happen? 00:11:13.000 --> 00:11:16.000 So here's an example I put together for you. 00:11:16.000 --> 00:11:21.000 In this case, what I did is I went to my device and I said, hey, VLAN 421 is remote SPAN. 00:11:21.000 --> 00:11:26.000 The thing is, is I have these two ports as access ports in that VLAN right now. 00:11:26.000 --> 00:11:35.000 What happens if I accidentally take my VLAN that has access ports in it and turn it into a remote SPAN VLAN? 00:11:35.000 --> 00:11:39.000 The ports go inactive. 00:11:39.000 --> 00:11:41.000 The ports go inactive. 00:11:41.000 --> 00:11:42.000 Look at that. 00:11:42.000 --> 00:11:44.000 Look at that. 00:11:45.000 --> 00:11:56.000 The ports go inactive because I turned their VLAN into an R-SPAN VLAN. 00:11:56.000 --> 00:11:59.000 Something to keep in mind. 00:11:59.000 --> 00:12:00.000 All right. 00:12:00.000 --> 00:12:09.000 Now when we look at this here, I have to make sure that all my switches know that VLAN, and they have to know that it's a remote SPAN VLAN. 00:12:10.000 --> 00:12:22.000 Or else how are we going to pass traffic from somebody like ASW2 over to DSW2 over to DSW1 and then over to ASW1 where my destination is going to be? 00:12:22.000 --> 00:12:27.000 So all the switches have to know that it's the VLAN number, and they have to know that it's the remote SPAN VLAN. 00:12:27.000 --> 00:12:30.000 So we do that on ASW1 as well, remote SPAN. 00:12:30.000 --> 00:12:31.000 And look at this. 00:12:31.000 --> 00:12:33.000 Look at the source. 00:12:33.000 --> 00:12:38.000 The source is going to be remote VLAN 500. 00:12:38.000 --> 00:12:45.000 If you forget the keyword of remote, what happens? 00:12:45.000 --> 00:12:51.000 Well, that creates a SPAN session, not an R-SPAN session, and that would mess everything up for you. 00:12:51.000 --> 00:12:52.000 You need the remote keyword. 00:12:52.000 --> 00:12:56.000 If the remote keyword is not there, then it's a SPAN session. 00:12:56.000 --> 00:13:07.000 That would be no different than doing something like this. 00:13:07.000 --> 00:13:08.000 No different. 00:13:08.000 --> 00:13:12.000 So with that in mind, right, make sure you don't forget that remote keyword. 00:13:12.000 --> 00:13:15.000 Pay attention to that. 00:13:15.000 --> 00:13:21.000 And then the VLAN is what is that remote SPAN VLAN where traffic is coming in, that copy traffic. 00:13:21.000 --> 00:13:22.000 And then where are we going to send it to? 00:13:22.000 --> 00:13:26.000 Monitor session 5, destination, interface gig 11. 00:13:26.000 --> 00:13:33.000 So if you're wondering if the session number has to match between the source and destination, well, on the device here it does. 00:13:33.000 --> 00:13:37.000 But if you're going to compare it to, for example, like ASW-2, no. 00:13:37.000 --> 00:13:44.000 So we go to ASW-2, you'll see we're using session 1 and ASW-2, and I'm using session 5 on ASW-1. 00:13:44.000 --> 00:13:51.000 That's fine because that number is locally significant to the device. 00:13:51.000 --> 00:13:52.000 And here's another. 00:13:52.000 --> 00:13:54.000 Here's some output. 00:13:54.000 --> 00:14:01.000 When you look at the output of show monitor, you'll see that it says remote, remote source session. 00:14:01.000 --> 00:14:03.000 That's how you know it's R-SPAN. 00:14:03.000 --> 00:14:09.000 So the source is either a VLAN or an interface or multiple VLANs or multiple interfaces, 00:14:09.000 --> 00:14:13.000 and the destination is the R-SPAN VLAN because it says remote. 00:14:13.000 --> 00:14:22.000 The remote destination session, the source would be the remote SPAN VLAN, and the destination would be your destination port. 00:14:22.000 --> 00:14:29.000 So if you're looking at R-SPAN output and it says local session, okay, then that means you configured it wrong. 00:14:29.000 --> 00:14:32.000 That means you forgot to put the keyword of what? 00:14:32.000 --> 00:14:34.000 Source, VLAN? 00:14:34.000 --> 00:14:36.000 Destination, VLAN? 00:14:36.000 --> 00:14:37.000 So remote, right? 00:14:37.000 --> 00:14:38.000 What was it? 00:14:38.000 --> 00:14:41.000 Remote VLAN. 00:14:41.000 --> 00:14:44.000 That was the difference. 00:14:44.000 --> 00:14:53.000 So here's another example of using an interface, setting a filter, so that way we only capture VLAN 50 traffic on that interface, 00:14:53.000 --> 00:14:58.000 and then we got our destination, which is the remote SPAN VLAN. 00:14:58.000 --> 00:15:00.000 So that's R-SPAN. 00:15:00.000 --> 00:15:06.000 Now, when you think about SPAN and R-SPAN, SPAN, we capture traffic on one interface on a switch 00:15:06.000 --> 00:15:09.000 and send it to a destination interface on the same switch. 00:15:09.000 --> 00:15:14.000 R-SPAN, one switch to the destination, different switch, but within that Layer 2 environment. 00:15:14.000 --> 00:15:15.000 Let's be clear here. 00:15:15.000 --> 00:15:18.000 It was within that Layer 2 environment. 00:15:18.000 --> 00:15:20.000 We did not leave that environment. 00:15:20.000 --> 00:15:22.000 We did not leave and go out into the core of the network. 00:15:22.000 --> 00:15:25.000 We stayed in this little environment here. 00:15:25.000 --> 00:15:36.000 So how in the world would I send my traffic to maybe a centralized monitoring or capturing solution that we have, 00:15:36.000 --> 00:15:39.000 let's say in a server farm, a data center we have? 00:15:39.000 --> 00:15:42.000 That's where E-R-SPAN comes into play. 00:15:42.000 --> 00:15:48.000 E-R-SPAN gives me the opportunity now to capture traffic on my devices, 00:15:48.000 --> 00:15:55.000 but send the copy of that captured traffic to another port on the same subnet 00:15:55.000 --> 00:15:58.000 or a different subnet across Layer 3 boundaries. 00:15:58.000 --> 00:16:03.000 So you'll see here that we have the traffic being captured on one device, 00:16:03.000 --> 00:16:08.000 but the other device, the destination device, is in a completely different subnet, 00:16:08.000 --> 00:16:13.000 completely different VLAN, completely different broadcast domain across a Layer 3 routed network. 00:16:13.000 --> 00:16:15.000 That's what E-R-SPAN does for us. 00:16:16.000 --> 00:16:19.000 And notice it's creating a type of GRE tunnel for us. 00:16:19.000 --> 00:16:25.000 So we can encapsulate the traffic and send it from one device to the other device across that Layer 3 network. 00:16:25.000 --> 00:16:28.000 So this is called encapsulated. 00:16:28.000 --> 00:16:31.000 Encapsulated remote SPAN. 00:16:31.000 --> 00:16:39.000 So encapsulated remote switch port analyzer is what we call it using GRE. 00:16:39.000 --> 00:16:41.000 So what happens here? 00:16:41.000 --> 00:16:43.000 We have our source session. 00:16:43.000 --> 00:16:48.000 We have a routable E-R-SPAN GRE encapsulated tunnel for our traffic, 00:16:48.000 --> 00:16:51.000 and then we have our E-R-SPAN destination. 00:16:51.000 --> 00:16:57.000 So traffic can be captured ingress or egress on ports or VLANs. 00:16:57.000 --> 00:16:59.000 Same as SPAN and R-SPAN. 00:16:59.000 --> 00:17:01.000 You can't mix VLANs and ports, though, like we said. 00:17:01.000 --> 00:17:06.000 Captured traffic is sent out a Layer 3 GRE tunnel interface to another device, 00:17:06.000 --> 00:17:09.000 and then the receiving device collects that captured traffic 00:17:09.000 --> 00:17:14.000 and sends out the port connected to the packet capturing device. 00:17:14.000 --> 00:17:16.000 And it's not supported on Layer 2 switching interfaces. 00:17:16.000 --> 00:17:20.000 We're dealing with routing interfaces here. 00:17:20.000 --> 00:17:25.000 So this supported product list is not up to date, folks, 00:17:25.000 --> 00:17:28.000 but you're not going to have to know which devices support E-R-SPAN. 00:17:28.000 --> 00:17:31.000 What I want you to realize is that it's not supported on all platforms, 00:17:31.000 --> 00:17:41.000 all products, or all versions of iOS. 00:17:41.000 --> 00:17:44.000 So check your documentation to find out if your device is supported. 00:17:44.000 --> 00:17:48.000 Now, you are going to have to know the config for a certification exam. 00:17:48.000 --> 00:17:55.000 So what we have to do is we have to set up our source session here. 00:17:55.000 --> 00:17:59.000 We have to set up our destination session here. 00:17:59.000 --> 00:18:03.000 But the construct can get a little confusing, 00:18:03.000 --> 00:18:10.000 so bear with me here as we go through this and take your time with me. 00:18:10.000 --> 00:18:14.000 I'm typing in monitor session 1 type E-R-SPAN source. 00:18:14.000 --> 00:18:16.000 E-R-SPAN source. 00:18:16.000 --> 00:18:19.000 This is the source device. 00:18:19.000 --> 00:18:22.000 So I'm typing in E-R-SPAN source. 00:18:23.000 --> 00:18:26.000 This device is going to have a different command we use. 00:18:26.000 --> 00:18:28.000 So we're going to get to that later. 00:18:28.000 --> 00:18:29.000 Why? 00:18:29.000 --> 00:18:30.000 Because it's the destination. 00:18:30.000 --> 00:18:31.000 This is the source. 00:18:31.000 --> 00:18:32.000 All right. 00:18:32.000 --> 00:18:42.000 Now, in the config, you're going to see the prompt change to monitor E-R-SPAN source. 00:18:42.000 --> 00:18:47.000 So what we're going to configure now is the source interfaces 00:18:47.000 --> 00:18:49.000 or source VLANs for capturing. 00:18:49.000 --> 00:18:53.000 So, for example, source interface gig 1-1-2-3 receive. 00:18:53.000 --> 00:18:55.000 We can set up a filter here as well. 00:18:55.000 --> 00:18:58.000 So on those interfaces, I only want to receive traffic from maybe a certain VLAN, 00:18:58.000 --> 00:19:00.000 a certain list, a certain network. 00:19:00.000 --> 00:19:10.000 We can do that as well by using your filter VLAN command like we did SPAN and E-R-SPAN. 00:19:10.000 --> 00:19:12.000 Sorry, SPAN and R-SPAN. 00:19:12.000 --> 00:19:14.000 I think I said E-R-SPAN, so SPAN and R-SPAN. 00:19:14.000 --> 00:19:15.000 All right. 00:19:15.000 --> 00:19:17.000 Or if you just want to capture traffic for a source VLAN, 00:19:17.000 --> 00:19:20.000 you go right in and type in source VLAN 10 or source VLAN 20 or source VLAN 30 00:19:20.000 --> 00:19:25.000 or source VLAN 11, 12, 13, whatever you want to capture that for. 00:19:25.000 --> 00:19:26.000 All right. 00:19:26.000 --> 00:19:35.000 So now that we've defined what sources for capturing, we have to specify our destination. 00:19:35.000 --> 00:19:36.000 And what is our destination? 00:19:36.000 --> 00:19:39.000 Where we're sending the captured traffic to. 00:19:39.000 --> 00:19:43.000 So remember, we're sending the captured traffic out a GRE tunnel. 00:19:43.000 --> 00:19:45.000 And so this is how we configure that. 00:19:45.000 --> 00:19:49.000 Now, this is totally different than the GRE tunnel configuration you would have learned 00:19:49.000 --> 00:19:53.000 previously or earlier in the Encore course. 00:19:53.000 --> 00:19:57.000 So under the configuration mode, we just type in destination. 00:19:57.000 --> 00:19:59.000 You're going to see how it changes the source destination now. 00:19:59.000 --> 00:20:05.000 This is important that you grasp this configuration and the flow of the configuration. 00:20:05.000 --> 00:20:08.000 So in the source section, we're specifying what ports we're capturing on, 00:20:08.000 --> 00:20:10.000 which VLANs we're capturing on. 00:20:10.000 --> 00:20:13.000 And then you type in destination, and that brings you into the destination config. 00:20:13.000 --> 00:20:15.000 So it says source destination. 00:20:15.000 --> 00:20:17.000 The source is destination configuration. 00:20:17.000 --> 00:20:19.000 That's what it means. 00:20:19.000 --> 00:20:25.000 Now, what we need to do is we need to create an ear span ID for the tunnel. 00:20:25.000 --> 00:20:27.000 So this is just something that you can come up with, right? 00:20:27.000 --> 00:20:29.000 So you type in your ear span ID. 00:20:29.000 --> 00:20:31.000 The thing is it has to match on both devices. 00:20:31.000 --> 00:20:34.000 If it doesn't match on both devices, it's not going to work for you. 00:20:34.000 --> 00:20:37.000 So it's got to match on both devices. 00:20:37.000 --> 00:20:42.000 Now we need to specify an IP address, and we need to specify an origin IP address. 00:20:42.000 --> 00:20:44.000 What's the difference between the two? 00:20:44.000 --> 00:20:50.000 It's very simple, and I really encourage you to make sure you know the difference between the two. 00:20:50.000 --> 00:21:01.000 It is source of tunnel, destination of tunnel. 00:21:01.000 --> 00:21:03.000 That's what that is. 00:21:03.000 --> 00:21:10.000 So IP address is the destination IP address of the tunnel. 00:21:10.000 --> 00:21:16.000 Origin IP address is the source of the GRE tunnel. 00:21:16.000 --> 00:21:25.000 And then you got to make sure you enable it with the no shutdown command. 00:21:25.000 --> 00:21:39.000 If it's missing, it's not going to work. 00:21:39.000 --> 00:21:45.000 Okay. 00:21:45.000 --> 00:21:50.000 So you're not actually going to be having to create a tunnel interface yourself 00:21:50.000 --> 00:21:55.000 or set up the GRE information other than what you see here. 00:21:55.000 --> 00:21:59.000 This does it all for you. 00:21:59.000 --> 00:22:05.000 Another filtering option you have up in the source that I want to mention that just came to my head was an ACL. 00:22:05.000 --> 00:22:08.000 So you could actually create an ACL if you wanted to. 00:22:08.000 --> 00:22:14.000 So, for example, let's say you created an access list. 00:22:14.000 --> 00:22:20.000 Let's say access list one, permit, x.x.x.x. 00:22:20.000 --> 00:22:21.000 So what did we just? 00:22:21.000 --> 00:22:22.000 We just specified what? 00:22:22.000 --> 00:22:25.000 We just specified a source range. 00:22:25.000 --> 00:22:30.000 So capture traffic for a specific source IP addressing range. 00:22:30.000 --> 00:22:33.000 And then you could specify the command. 00:22:33.000 --> 00:22:34.000 What is it? 00:22:34.000 --> 00:22:40.000 Filter access group under the source. 00:22:40.000 --> 00:22:43.000 So filter access hyphen group and then the number. 00:22:43.000 --> 00:22:44.000 So access list one. 00:22:44.000 --> 00:22:47.000 So one, one. 00:22:47.000 --> 00:22:54.000 And then that would ensure that you only capture the traffic for that particular source. 00:22:54.000 --> 00:22:59.000 So if you wanted to specify a source subnet or a subset of that source subnet or multiple subnets, right, 00:22:59.000 --> 00:23:11.000 you can get creative with your ACL address and wildcard mask combination to get the exact results that you want. 00:23:11.000 --> 00:23:13.000 Now let's talk about the destination device. 00:23:13.000 --> 00:23:18.000 So the destination device, we have our monitor session one type. 00:23:18.000 --> 00:23:19.000 Look at that. 00:23:19.000 --> 00:23:20.000 ER span destination. 00:23:20.000 --> 00:23:21.000 So the other one was ER span source. 00:23:21.000 --> 00:23:23.000 This one is ER span destination. 00:23:24.000 --> 00:23:29.000 So then in the top config here under destination, we configure the destination interface. 00:23:29.000 --> 00:23:34.000 So that's this interface here that has the Wireshark device connected to it. 00:23:34.000 --> 00:23:37.000 Then you have to specify the source of the GRE tunnel. 00:23:37.000 --> 00:23:40.000 So source of GRE tunnel. 00:23:40.000 --> 00:23:41.000 So there's that. 00:23:41.000 --> 00:23:47.000 You've got to match the ER span ID from the other device. 00:23:47.000 --> 00:23:51.000 Then you have to specify the incoming IP address of the device. 00:23:51.000 --> 00:23:56.000 Notice how you don't have to specify the IP address of the source here because you have the ER span ID. 00:23:56.000 --> 00:24:04.000 So it says if traffic arrives on this interface and it's got this information, the ER span ID 101, 00:24:04.000 --> 00:24:13.000 then that is the traffic that is going to be taken from that source and sent to our destination. 00:24:13.000 --> 00:24:17.000 So the destination device is the destination config first, the source config second. 00:24:17.000 --> 00:24:20.000 On this device, it's source config first, destination config second. 00:24:20.000 --> 00:24:21.000 So in this case, what is the source? 00:24:21.000 --> 00:24:26.000 The source is any traffic coming into this interface with an ER span ID of 101. 00:24:26.000 --> 00:24:27.000 I'm going to take that. 00:24:27.000 --> 00:24:29.000 I'm going to send it to that interface. 00:24:29.000 --> 00:24:30.000 And that's the config. 00:24:30.000 --> 00:24:37.000 You must know this config. 00:24:37.000 --> 00:24:41.000 So span, R span, ER span. 00:24:41.000 --> 00:24:48.000 Review this a few times to make sure you're comfortable with what I've presented to you about these three different solutions. 00:24:50.000 --> 00:24:51.000 Thank you.