Document Number Based on Template Created By EDCS-XXXXXX EDCS-XXXX Rev X Matthew Wronkowski mwronkow@cisco.com Nexus 1000v ERSPAN This document describes the configuration for ERSPAN sessions created on Nexus 1000v and terminated on N7k or 6500 devices. Please let me know if your topology is not covered by the examples in this document. Modification History Rev. Date Originator Release Comment 1.0 12/6/11 Matthew Wronkowski - Original version Table of Contents Nexus 1000v ERSPAN...1 Limitations...2 Topology...2 Nexus 1000v configuration...2 Nexus 7000 configuration...3 N1k ERSPAN to Catalyst 6500...4 Verification of ERSPAN...4 References:...5
Limitations N7k only supports 1 source IP per ERSPAN-DESTINATION. This means each ESX host needs a separate monitor session. Due to this limitation this is not a scalable solution for ongoing host monitoring. A scalable solution would be NetFlow with NAM. Topology Testing was completed under Nexus 1000v SV1(4a) and Nexus 7000 5.1(4). Nexus 1000v configuration ERSPAN requires a vmkernel interface which is used as the GRE tunnel source. This vmkernel can be the same as the management vmk or it can be a dedicated interface. The port-profile capability l3control command indicates this interface will be used for Layer 3 communication. Create a new vmkernel and port-profile or add the capability command to an existing port-profile. Note this command cannot be removed from the port-profile while it is assigned to vethernet interfaces. Best practice would be to define a port-profile specifically for monitor sessions. The monitor session only requires the source traffic type and a destination IP configured. All other parameters are optional. The source can be an interface, port-channel, or vlan. The destination IP is the address of the target device. For Nexus 7000 or 6500 this is typically an SVI(interface vlan) and not the supervisor management address. Although the IP addresses used in the examples reside in the same subnet, this is not required. If a destination device will be receiving traffic from multiple sources it may be necessary to configure an ERSPAN-ID. This configuration is the same regardless of the ERSPAN destination device. Remember to the monitor session.
# VSM configuration port-profile type vethernet ERSPAN_SC capability l3control vmware port-group switchport mode access switchport access vlan 119 system vlan 119 description ESX vmk state enabled monitor session 2 type erspan-source source vlan 119 rx destination ip 14.17.119.55 <- NAM/N7k/6500 IP ip ttl 64 ip prec 0 ip dscp 0 mtu 1500 header-type 2 Nexus 7000 configuration Begin by defining a target IP for the ERSPAN. This can be any IP address reachable by the ESX vmkernel interface in port-profile ERSPAN_SC. Next create an ERSPAN-DESTINATION monitor session. The source IP will be the vmkernel in the ERSPAN_SC port-profile. One limitation of N7k is only a single source IP per monitor session is allowed. Finally configure the destination of the ERSPAN. In this example we send traffic to a physical interface with a probe attached. interface Vlan119 ip address 14.17.119.55/24 <- Termination of ERSPAN tunnel interface Ethernet2/1 description incoming GRE tunnel switchport switchport mode trunk interface Ethernet2/3 description Monitor - connect to PC switchport switchport monitor spanning-tree port type edge trunk
monitor session 1 type erspan-destination description ERSPAN from N1k-VEM <- Optional SPAN-ID vrf default source ip 14.17.119.60 <- ESX host vmk destination interface Ethernet2/3 N1k ERSPAN to Catalyst 6500 Begin by defining a target IP for the ERSPAN. This can be any IP address reachable by the ESX vmkernel interface in port-profile ERSPAN_SC. Next create an ERSPAN-DESTINATION monitor session. The source IP will be the SVI interface on the 6500. This may not be intuitive that SVI IP is used instead of the ESX vmk. Essentially we are telling the 6500 to listen on the SVI for incoming ERSPAN sessions. interface Vlan119 ip address 14.17.119.55/24 <- Termination of ERSPAN tunnel monitor session 1 type erspan-destination description ERSPAN from N1k-VEM destination interface Gi2/3 source <- Optional SPAN-ID ip address 14.17.119.55 <- 6500 SVI Verification of ERSPAN SV14# show monitor session 2 session 2 --------------- type : erspan-source state : up source intf : rx : source VLANs : rx : 119 source port-profile : rx : filter VLANs : filter not specified destination IP : 14.17.119.55 ERSPAN ID : 111 ERSPAN TTL : 64
ERSPAN IP Prec. : 0 ERSPAN DSCP : 0 ERSPAN MTU : 1500 ERSPAN Header Type: 2 SV14# module vem 5 execute vemcmd show span VEM SOURCE IP: 14.17.119.60 HW SSN ID ERSPAN ID HDR VER DST LTL/IP 2 111 2 14.17.119.55 SV14# show monitor internal info session 2 SV14# show monitor internal event-history session 2 References: Configuring Local SPAN and ERSPAN 6500: Configuring ERSPAN