ERSPAN Between Two Routers

[ty.chan007]

I am trying to mirror traffic from one router to another with below config:

R1:

R1#sh run | sec monitor 

monitor session 1 type erspan-source

source interface Gi0/0/3 rx

destination

  erspan-id 100

  ip address 192.168.0.0

  origin ip address 192.168.0.1

R11#sh monitor session all

Session 1

---------

Type                   : ERSPAN Source Session

Status                 : Admin Enabled

Source Ports           :

    RX Only            : Gi0/0/3

Destination IP Address : 192.168.0.0

Destination ERSPAN ID  : 100

Origin IP Address      : 192.168.0.1

R2:

R2#sh run | sec monitor

monitor session 1 type erspan-destination

destination interface Gi0/0/4

source

  erspan-id 100

  ip address 192.168.0.1

R2#sh monitor session all

Session 1

---------

Type                   : ERSPAN Destination Session

Status                 : Admin Enabled

Destination Ports      : Gi0/0/4

Source IP Address      : 192.168.0.1

Source ERSPAN ID       : 100

R2#sh platform hardware qfp active feature erspan state

ERSPAN State:

  Status    : Active

  Complexes : 1

  CPPs      : 1

Capabilites:

  Max sessions : 1024

  Max outputs  : 128

  Encaps type  : ERSPAN type-II

  GRE protocol : 0x88BE

  MTU          : 1464

  IP TOS       : 0

  IP TTL       : 255

  COS          : 0

System Statistics:

  DROP src session replica  :                  0 /                  0

  DROP term session replica :                  0 /                  0

  DROP receive malformed    :                  0 /                  0

DROP receive invalid ID   :           24321174 /        21427043334

  DROP recycle queue full   :                  0 /                  0

  DROP no GPM memory        :                  0 /                  0

  DROP no channel memory    :                  0 /                  0

Client Debug Config:

  Enabled: Info, Warn

Data Path Debug Config:

  0x00000000

Note:  192.168.0.0 is R2's loopback. 192.168.0.1 is R1's loopback.

The configuration seems OK and traffic was mirror from R1 to R2 but it was dropped at R2 with DROP receive invalid ID increasing.

What could go wrong? please help.

[nkarpysh]

Hello,

The ERSPAN-Destination session should have the Source IP Address as the

IP address (192.168.0.0) and not the Origin IP Address which you have

configured.

Try changing that and let me know if that helped.

Nik

+pls grade if helpful

[ty.chan007]

Do you mean i need to change on R2 as below:

From:

monitor session 1 type erspan-destination

destination interface Gi0/0/4

source

  erspan-id 100

  ip address 192.168.0.1

To:

monitor session 1 type erspan-destination

destination interface Gi0/0/4

source

  erspan-id 100

  ip address 192.168.0.0

Note:  192.168.0.0 is R2's loopback. 192.168.0.1 is R1's loopback.

I did that but ERSPAN stop working.

[nkarpysh]

Can you paste the current output for

show platform hard qfp active feature erspan state

Previously "DROP receive invalid ID" indicated exactly that erspan-id (or ips) in source and destination session didnot match.

And that is due to ip was incorrect-  I guess that is bug of documentation explaining that. Current config is correct.

From what I have seen there two things to try:

1. Remove ERSPAN completely from source and destination and apply again with defferent session id

if that did not help try option 2:

2. Configure "plim ethernet vlan filter disable" on destination router destination interface Gi0/0/4 as sometime problem is related to VLAN tags coming in ethernet header of captured frames.

Nik

+pls grade if helpful

[ty.chan007]

I have remove and add again with same and different session ID but not success. Below is the update result:

ASBR02-ANA#sh platform hardware qfp active feature erspan state

ERSPAN State:

  Status    : Active

  Complexes : 1

  CPPs      : 1

Capabilites:

  Max sessions : 1024

  Max outputs  : 128

  Encaps type  : ERSPAN type-II

  GRE protocol : 0x88BE

  MTU          : 1464

  IP TOS       : 0

  IP TTL       : 255

  COS          : 0

System Statistics:

  DROP src session replica  :                  0 /                  0

  DROP term session replica :                  0 /                  0

  DROP receive malformed    :                  0 /                  0

  DROP receive invalid ID   :          471497498 /       443368261666

  DROP recycle queue full   :                  0 /                  0

  DROP no GPM memory        :                  0 /                  0

  DROP no channel memory    :                  0 /                  0

Client Debug Config:

  Enabled: Info, Warn

Data Path Debug Config:

  0x00000000

The number keep increasing. Did try your command on the G0/0/4 but still not help.

[nkarpysh]

Can you please share the current config.

Nik

[ty.chan007]

R1:

R1#sh run | sec monitor

monitor session 1 type erspan-source

source interface Gi0/0/3 rx

destination

  erspan-id 100

  ip address 192.168.0.0

  origin ip address 192.168.0.1

R2:

R2#sh run | sec monitor

monitor session 1 type erspan-destination

destination interface Gi0/0/4

source

  erspan-id 100

  ip address 192.168.0.1

Note:  192.168.0.0 is R2's loopback. 192.168.0.1 is R1's loopback.

[nkarpysh · Accepted solution]

I see you again reverted to original config. As I told above that is wrong - ip address in destination session and ip address in source session should match. If they dont- that is causing the drops you see.

So I recoemnd following:

- remove both sessions completely

- configure both with new session id - e.g. 101

- configure "ip address" in source and destination sessions to be 192.168.0.0

- have "plim ethernet vlan filter disable"command on outgoing interface

Nik

[ty.chan007]

Hi Nik, It works now following exactly as you told. but don't really understand why it config that way.

Many Thanks

[nkarpysh]

Glad it works.

Thing is that documentation seems to be not correct. "ip address" in source and destination should match and in guides I often see destination ip address matching to originator id which is wrong and we corrected it.

As for "plim ethernet vlan filter disable" - it is used to disable filter for packets tagged with VLAN as by default ASR drop them in older versions. I guess in later codes they overcome it.

Nik