Cisco Nexus 3548 Configuration Manual page 179

Configuring ERSPAN
• A single ERSPAN session can include mixed sources in any combination of the following:
• Destination ports do not participate in any spanning tree instance or Layer 3 protocols.
• When an ERSPAN session contains source ports that are monitored in the transmit or transmit and
receive direction, packets that these ports receive may be replicated to the ERSPAN destination port
even though the packets are not actually transmitted on the source ports. Some examples of this behavior
on source ports include:
• When Nexus 3548 is the ERSPAN destination, GRE headers are stripped off before sending mirrored
packets out of the terminating point.
• ERSPAN does not support 1588 granularity mode, and rejects this mode if selected.
• ERSPAN supports 100 microseconds (ms), 100 nanoseconds (ns), and ns granularity.
• ERSPAN sends all timestamps in 32-bit format. Therefore, the timestamp field will wrap periodically.
When the switch is set to ns granularity, this field will wrap every 4.29 seconds.
• A Layer 3 subinterface cannot be configured as an ERSPAN source interface.
• All ERSPAN sources terminating in a single destination box must use the same destination IP address.
• You cannot configure different source IP addresses in different ERSPAN destination sessions.
• Layer 3 switched traffic from VLAN X to VLAN Y, which is spanned through the ERSPAN source in
either the Rx or Tx direction, will carry VLAN information in the ERSPAN header of VLAN X (the
VLAN before Layer 3 switching or ingress VLAN).
• Traffic coming in on an access port or a Layer 3 interface, which is part of an ERSPAN source session,
will not have VLAN information in the ERSPAN header (VLAN ID 0). This could result in
incompatibility issues with Catalyst 6000, which expects a non-zero VLAN ID.
• Multicast flood packets that do not go out of the ERSPAN source interface, which is configured for the
egress (Tx) direction, can still reach the ERSPAN destination. This is because egress spanned packets
are spanned before the original egress port is selectively enabled to receive specific frames and drop
others, whereas the span for the Nexus 3548 switch application-specific integrated circuit (ASIC) is
based on the monitor port's property. As a result, the spanned packet is still sent to the remote destination.
This is expected behavior from platforms specific to multicast flood and is not seen for other traffic
streams.
• Replicated multicast packets sent out of the ERSPAN source in the Tx direction are not sent to the
ERSPAN destination.
◦ Ethernet ports or port channels but not subinterfaces.
◦ VLANs or port channels, which can be assigned to port channel subinterfaces.
◦ The port channels to the control plane CPU.
ERSPAN does not monitor any packets that are generated by the supervisor, regardless
Note
of their source.
◦ Traffic that results from flooding
◦ Broadcast and multicast traffic
Cisco Nexus 3548 Switch NX-OS System Management Configuration Guide, Release 6.x
Guidelines and Limitations for ERSPAN
163