Exam 350-401 topic 1 question 536 discussion

https://www.networkstraining.com/how-to-configure-cisco-span-rspan-erspan/ The flow ID (erspan-id) must be the same on both devices (to identify the ERSPAN traffic). Under erspan-source, the destination IP is the IP where we want to send the traffic (e.g. the machine with an analyzer). The origin IP address is the source of the traffic to be monitored. Under erspan-destination, the source IP address is the same as the destination IP address of the corresponding source session. The session IDs (#monitor session ...) don’t have to match for the source session and end session.

R1(config)#monitor session 1 type erspan-source R1(config-mon-erspan-src)#source interface GigabitEthernet 2 rx R1(config-mon-erspan-src)#no shutdown R1(config-mon-erspan-src)#destination R1(config-mon-erspan-src-dst)#erspan-id 100 R1(config-mon-erspan-src-dst)#ip address 172.16.2.200 R1(config-mon-erspan-src-dst)#origin ip address 172.16.12.1 R2(config)#monitor session 1 type erspan-destination R2(config-mon-erspan-dst)#no shutdown R2(config-mon-erspan-dst)#destination interface GigabitEthernet 2 R2(config-mon-erspan-dst)#source R2(config-mon-erspan-dst-src)#erspan-id 100 R2(config-mon-erspan-dst-src)#ip address 172.16.2.200

Monitor session numbers can be different. Erspan-id must be the same.

B is correct

B is correct

Select Answer: B https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9600/software/release/16-11/configuration_guide/nmgmt/b_1611_nmgmt_9600_cg/configuring_erspan.html

The flow ID (erspan-id) must be the same on both devices (to identify the ERSPAN traffic). Under erspan-source, the destination IP is the IP where we want to send the traffic (e.g. the machine with an analyzer). The origin IP address is the source of the traffic to be monitored. Under erspan-destination, the source IP address is the same as the destination IP address of the corresponding source session. The session IDs (#monitor session ...) don’t have to match for the source session and end session.

the Source IP on the erspan-dest need to match what is configured on erspan-source, using the command origin ip address.

C is the correct answer. Remenber that the ip adress for destiny (SW2) must be the origin of the first equipment (SW1)

Similar example: https://study-ccnp.com/erspan-encapsulated-remote-span-explained/

B (SOURCE) R1(config)#monitor session 11 type erspan-source R1(config-mon-erspan-src)# description SOURCE R1(config-mon-erspan-src)#source interface GigabitEthernet 3 R1(config-mon-erspan-src)#no shutdown R1(config-mon-erspan-src)#destination R1(config-mon-erspan-src-dst)#erspan-id 12 R1(config-mon-erspan-src-dst)#ip address 10.10.10.10 R1(config-mon-erspan-src-dst)#origin ip address 10.100.10.10 R1(config-mon-erspan-src-dst)#ip ttl 32 R1(config-mon-erspan-src-dst)#end (DESTINATION) R2(config)#monitor session 12 type erspan-destination R2(config-mon-erspan-dst)# description DESTINATION R2(config-mon-erspan-dst)#destination interface GigabitEthernet 4 R2(config-mon-erspan-dst)#no shutdown R2(config-mon-erspan-dst)#source R2(config-mon-erspan-dst-src)#erspan-id 12 R2(config-mon-erspan-dst-src)#ip address 10.10.10.10 -------->>> Here is my local source

of course not covered in OCG. the more questions im looking at i think OCG is kind of sabotage.

Other sample of Erspan configuration Router1(config)#monitor session 1 type erspan-source Router1(config-mon-erspan-src)# description SOURCE Router1(config-mon-erspan-src)#source interface GigabitEthernet0/0/1 rx Router1(config-mon-erspan-src)#no shutdown Router1(config-mon-erspan-src)# Router1(config-mon-erspan-src)#destination Router1(config-mon-erspan-src-dst)#erspan-id 10 Router1(config-mon-erspan-src-dst)#ip address 172.16.30.254 Router1(config-mon-erspan-src-dst)#origin ip address 172.16.20.10 Router2(config)#monitor session 1 type erspan-destination Router2(config-mon-erspan-dst)#description DESTINATION Router2(config-mon-erspan-dst)#no shutdown Router2(config-mon-erspan-dst)#destination interface GigabitEthernet0/0/1 Router2(config-mon-erspan-dst)#source Router2(config-mon-erspan-dst-src)#erspan-id 10 Router2(config-mon-erspan-dst-src)#ip address 172.16.30.254 https://study-ccnp.com/erspan-encapsulated-remote-span-explained/#:~:text=ERSPAN%20Configuration&text=To%20configure%20the%20destination%2C%20enter,be%20sent%20to%20be%20analyzed.

ERSPAN has two main devices, the source device from which the mirrored traffic will be originated from, and the destination device where the packet analyzer tool is connected and for which the mirrored packets will be forwarded two. And these devices create a tunnel between each other to encapsulate the mirrored traffic across a layer 3 network. >ERSPAN Source Device needs to configure the following: --> 1) Define the Monitor Session and the type of ERSPAN (Source) monitor session <id> type erspan-source --> 2) Define the Source Interface or VLAN. Where the mirrored traffic originates from source interface <interface> or source vlan <vlan-id> --> 2a) Enter Destination configuration mode and: destination --> 3) Define the ERSPAN ID (THIS MUST MATCH ON BOTH DEVICES) erspan id <id> --> 4) Define the Destination IP address. This is the remote device's address ip address <address> -->5) Define the Origin IP address that connects the other end of the ERSPAN tunnel origin ip address <address> Continued...

Help me out on this one please. I'm hung up with the monitor session command 11 having to match. Why is this wrong?

Answer is B

A. monitor session 11 type erspan-destination destination interface GigabitEthemet4 source erspan-id 11 ip address 10.10.10.10 B. monitor session 12 type erspan-destination destination interface GigabitEthernet4 source erspan-id 12 ip address 10.10.10.10 C. monitor session 11 type erspan-destination destination interface GigabitEthernet4 source erspan-id 12 ip address 10.100.10.10 D. monitor session 12 type erspan-destination destination interface GigabitEthernet4 source erspan-id 11 ip address 10.10.10.10