ACI SPAN

SPAN

Types of SPAN

1. Local SPAN : Supported by Cisco

Traffic is mirrored to an interface on the same leaf as the source of the SPAN i.e single leaf has both source as well as destination. Only Access SPANs can be setup as local.

1.  Remote SPAN (RSPAN) : Not Supported by Cisco

2.  Encapsulated Remote SPAN (ERSPAN) : Supported by Cisco : destination ip must be learnt as an endpoint.

Destination IP could be in the same or different VRF i.e. anywhere in fabric.

Types of SPAN as per Cisco ACI

• Fabric SPAN  is to capture packets from interfaces between Leaf and Spine switches.It supports ERSPAN

• Access SPAN is to capture packets from interfaces between Leaf switches and external devices.It supports both Local & ERSPAN

• Tenant SPAN  is to capture packets from EndPoint Group (EPG) on ACI Leaf switches.It supports ERSPAN

Access SPAN is to capture packets from interfaces between Leaf switches and external devices.It supports both Local & ERSPAN.

1. Let’s configure Local Span for both Source & Destination

Create a Destination Group name “Local_Span_Destination”... Let the Packet Sniffer Server be on Leaf 101 port 1.

Create a Source Group name “Local_Span_Source”... Let the Source be on Leaf 101 port 2.

Attach Destination SPAN group to Source group.

2. Destination is local & Source is EPG

3. Source & Destination both could be EPG

Note : In Destination EPG we need to define source & destination ip address.

Fabric SPAN

Fabric → Fabric Policies → Policies → Troubleshooting → SPAN → Destination GRP

Destination Group can be EPG only

Source can be optionally binded with traffic from VRF or BD instead of all traffic

Note : Interface of Spine switches connected to leaf are from range 49-52.