ERSPAN between teo Cat 9500

[Nils 86]

hi everyone,

i want to setup a monitor session over a routed core network using the ERSPAN feature. the ERSPAN Source is a Cat 9500 (IOS 17.3.7) with this configuration
monitor session 55 type erspan-source
source interface Twe1/0/1 , Twe1/0/32
destination
erspan-id 55
mtu 1400
ip address 1.1.1.1
origin ip address 2.2.2.2

the destination is a Cat 9500 (IOS 17.9.5)
with the configuration

monitor session 55 type erspan-destination
shutdown
destination interface Twe1/0/1
source
erspan-id 55
ip address 2.2.2.2

there is no out comming traffic on interface twe1/0/1 and evertime the traffic is getting higher, the destination Cat9500 lost his connection and is no longer available.

is the Cat 9500 able to terminate a ERSPAN Session?

thanks and regards 
Nils 

[balaji.bandi]

yes that is support ERSPAN, why shutdown command there in the config ?

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-9500-series-switches/218111-verify-span-and-erspan-on-catalyst-9000.html#toc-hId-1224900067

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/16-9/configuration_guide/nmgmt/b_169_nmgmt_9500_cg/configuring_erspan.html

[Nils 86]

hey @balaji.bandi  

thanks for your response, sorry in the "real" config on the switch there is no "shutdown" 

[Nils 86]

XXXXX#show monitor session 55
Session 55
----------
Type : ERSPAN Source Session
Status : Admin Enabled
Source Ports :
Both : Twe1/0/1,Twe1/0/32
Destination IP Address : XXXXX
MTU : 9000
Destination ERSPAN ID : 55
Origin IP Address : XXXXX

XXXXX#show monitor session 55
Session 55
----------
Type : ERSPAN Destination Session
Status : Admin Enabled
Destination Ports : Twe1/0/1
Source IP Address : XXXXXXX
Source ERSPAN ID : 55

[balaji.bandi]

i see both the switch name XXXX ( you know the ERSPAN rule check the guide line

you can not have source and destination same port.

[Nils 86]

@balaji.bandi  there a two different switches, XXXX is not the realname of the device and there are two different ports twe 1/0/1 on the first an twe 1/0/1 on the second.... the switches are connected over a routet network. and the MTU size is always higher than 9000. 

regards Nils

[balaji.bandi]

what is connected on these ports ?

Twe1/0/1 , Twe1/0/32

do you see any traffic ?

Try Local span and confirm you see some traffic top span locally before you do ERSPAN

[Nils 86]

i have testet sending the traffic with my pc as the destination of the ERSPAN session and displayed it with wireshark. that works! i think the problem is on the destination switch... 

[balaji.bandi]

other thank IOS XE code both the switches are same. (until there are some bugs around the code)