Packet Capture Using Encapsulated Remote SPAN
For various reasons, including compliance, enterprises are looking for ways to capture data for further analysis (using an intrusion detection/prevention system [IDS/IPS] or some other advanced analysis system). NetFlow proves handy for this purpose, where you can get detailed IP flow accounting information for the given network.
NetFlow, however useful, still does not provide full packet capture capability from Layer 2 to 7. This is where the Switch Port Analyzer (SPAN) function steps in, although as the name says, this is limited to switches only. SPAN or Remote SPAN (RSPAN), where monitored traffic can traverse a Layer 2 cloud or network, essentially creates an opportunity to capture and analyze traffic on two different switches that are part of a single Layer 2 domain (as opposed to a Layer 3 routing domain). Encapsulated Remote SPAN (ERSPAN), as the name says, brings generic routing encapsulation (GRE) for all captured traffic and allows it to be extended across Layer 3 domains. Until recently, ERSPAN has been available only on Catalyst 6500 and 7600 platforms.
The Cisco ASR 1000 originated with ERSPAN support and can operate in two ways:
- As source or destination for ERSPAN sessions
- As source and destination for ERSPAN sessions at the same time
Note, as well, that this implementation is interoperable with Catalyst 6500 and 7600, and so traffic captured on a port/interface attached to an ASR 1000 can be sent to a destination monitoring station over to a 6500/7600 across a Layer 3 domain as a GRE packet.
Use Case: Ethernet Frame Capture and Transport Across a Layer 3 Cloud
An enterprise has an ASR 1000 being used at one of the regional HQs in San Francisco, and needs to capture traffic from an interface on an on-demand basis and bring it to the centralized data center location in Austin, terminating it on a Catalyst 6500 switch in the core. The San Francisco and Austin locations are connected via a shared MPLS IP VPN cloud.
To meet the requirement needed for this enterprise, you need to implement ERSPAN on the ASR 1000 in the SF HQ location as a source session and terminate it at the Catalyst 6500 switch in the core.
Figure 12-2 shows the ERSPAN source (monitored) and destination (monitoring) ports on the ASR 1000 and Catalyst 6500, respectively.
)
Figure 12-2 Ethernet frame capture at the WAN headend and transporting them to data center via a Layer 3 cloud.
Begin with the configuration on the ASR 1000. Here we'll configure source interface, direction of traffic, and ERSPAN session ID.
- Step 1. Identify the ports/interfaces that need to be monitored, and the direction of traffic that needs to be captured, (for example, Rx) by entering the following commands:
ASR1006(config)# monitor session 1 type erspan-source ASR1006(config-mon-erspan-src)# source interface Fe1/0/1 rx ASR1006(config-mon-erspan-src)# destination ASR1006(config-mon-erspan-src-dst)# erspan-id 100 ASR1006(config-mon-erspan-src-dst)# ip address 10.10.0.1 ASR1006(config-mon-erspan-src-dst)# ip ttl 32 ASR1006(config-mon-erspan-src-dst)# origin ip address 172.16.0.1 - Step 2. Configure the Catalyst 6500 to receive traffic from the source session on the ASR 1000 from Step 1:
Cat6500(config)# monitor session 2 type erspan-destination Cat6500(config-mon-erspan-dst)# destination interface gigabitEthernet 2/2/0 Cat6500(config-mon-erspan-dst)# source Cat6500(config-mon-erspan-dst-src)# erspan-id 100 Cat6500(config-mon-erspan-dst-src)# ip address 172.16.0.1You can use the show monitor session command to verify the configuration:ASR1006# show monitor session 1 Session 1 --------- Type : ERSPAN Source Session Status : Admin Enabled Source Ports :
RX Only:Fe1/0/1Destination IP Address : 10.10.0.1 Destination ERSPAN ID : 100 Origin IP Address : 172.16.0.1 IP TTL : 32 - Step 3. To be able to monitor the statistics of monitored traffic, you need to use show platform hardware qfp active feature erspan state command:
ASR1006# show platform hardware qfp active feature erspan state ERSPAN State: Status : Active ----output truncated---- System Statistics: DROP src session replica : 0 / 0 DROP term session replica : 0 / 0 DROP receive malformed : 0 / 0 DROP receive invalid ID : 0 / 0 DROP recycle queue full : 0 / 0 DROP no GPM memory : 0 / 0 DROP no channel memory : 0 / 0
This will achieve the purpose of capturing received traffic on the ASR 1000 (FE1/0/1) to Catalyst 6500 GE2/2/0. This traffic will simply be captured, encapsulated in GRE by ASR 1000 natively by the QFP chipset and routed over to the Catalyst 6500. A sniffing station on the 6500 attached to GE2/2/0 will see the complete Ethernet frame (L2 to L7) up to jumbo size (assuming the routed WAN infrastructure can carry jumbo frames end to end).
The ASR 1000, being the first midrange routing platform to support ERSPAN, adds tremendous value to data capturing and data visibility end to end from a branch, or from HQ to data center, a common requirement in medium to large enterprise networks. ERSPAN packet replication is natively done by the QFP chipset, and therefore no external modules are required. ERSPAN, when combined with NetFlow, can result in detailed end-to-end network visibility.