GigaSMART ERSPAN Tunnel Decapsulation

Some Cisco equipment provides the ability to mirror monitored traffic to a remote destination through an ERSPAN tunnel. Using ERSPAN tunnel decapsulation, GigaSMART can act as the receiving end of an ERSPAN tunnel, decapsulating mirrored traffic sent over the Internet from a Cisco switch or router.

ERSPAN Tunnel Header Removal Example

In this example, a tunnel is configured to capture ERSPAN packets, then the ERSPAN header is removed and the packets are forwarded to a tool port.

Step

Description

Command
1.    

Configure a network port and tool type of port.

(config) # port 1/1/g2 type network

(config) # port 1/1/g1 type tool
2.  

Configure a GigaSMART group and associate it with a GigaSMART engine port.

(config) # gsgroup alias gsgp1 port-list 1/3/e1
3.  

Configure the IP interface.

(config) # ip interface alias test

(config ip interface alias test) # attach 1/1/g2

(config ip interface alias test) # ip address 10.10.10.10 /29

(config ip interface alias test) # gw 10.10.10.1

(config ip interface alias test) # mtu 9400

(config ip interface alias test) # gsgroup add gsgp1

(config ip interface alias test) # exit
4.  

Configure the GigaSMART operation and assign it to the GigaSMART group.

Note:  A flow ID of zero is a wildcard value that matches all flow IDs.

(config) # gsop alias er1 tunnel-decap type erspan flow-id 0 port-list gsgp1
5.  

Create a map.

(config) # map alias ermap

(config map alias ermap) # type regular byRule

(config map alias ermap) # use gsop er1

(config map alias ermap) # rule add pass protocol gre

(config map alias ermap) # from 1/1/g2

(config map alias ermap) # to 1/1/g1

(config map alias ermap) # exit

(config) #
6.  

Display the configuration for this example.

(config) # show gsgroup

(config) # show gsop

(config) # show ip interfaces

(config) # show map

ERSPAN Type III Tunnel Header Removal Example

In this example, a tunnel is configured to capture ERSPAN packets. ERSPAN Type III packets are parsed, the ERSPAN header is removed, and the timestamp is calculated. A timestamp trailer is added before the packets are forwarded to a tool port.

Step

Description

Command
1.    

Configure a tool type of port.

(config) # port 1/1/g1 type tool
2.  

Configure a GigaSMART group and associate it with a GigaSMART engine port.

(config) # gsgroup alias gsgp1 port-list 1/3/e1
3.  

Configure the IP interface.

(config) # ip interface alias test

(config ip interface alias test) # attach 1/1/g1

(config ip interface alias test) # ip address 10.10.10.10 /29

(config ip interface alias test) # gw 10.10.10.1

(config ip interface alias test) # mtu 9400

(config ip interface alias test) # gsgroup add gsgp1

(config ip interface alias test) # exit
4.  

Configure the GigaSMART operation and assign it to the GigaSMART group.

Note:  A flow ID of zero is a wildcard value that matches all flow IDs.

(config) # gsop alias gsop_erspan tunnel-decap type erspan flow-id 0 port-list gsgp1
5.  

Configure a timestamp trailer format.

(config) # gsparams gsgroup gsgp1 erspan3-timestamp format gs
6.  

Create a map. The map contains a rule to allow marker packets (UDP) to be processed.

(config) # map alias ermap

(config map alias ermap) # type regular byRule

(config map alias ermap) # use gsop gsop_erspan

(config map alias ermap) # rule add pass protocol gre

(config map alias ermap) # rule add pass protocol udp

(config map alias ermap) # from 1/1/g2

(config map alias ermap) # to 1/1/g1

(config map alias ermap) # exit

(config) #
7.  

View the the ERSPAN III timestamp

(config) # show gsparams
8.  

View the ERSPAN statistics.

(config) # show gsop stats alias gsop_erspan

Refer to the “ERSPAN Statistics Definitions” section and to the “GigaSMART Operations Statistics Definitions” in the GigaVUE Fabric Management Guide for details.