RSPAN and ERSPAN support

RSPAN and ERSPAN compatibility for Vectra Sensors, including VLAN tag limits.

As of v9.10, Vectra Sensors can decapsulate ERSPAN traffic. RSPAN is also supported as long as it arrives with no more than two VLAN tags. Please continue reading for more details.

RSPAN vs ERSPAN:

• RSPAN encapsulates SPAN traffic in a VLAN tag, permitting its encapsulation across VLAN trunk links between switches. This traffic remains at layer 2.

• ERSPAN encapsulates SPAN traffic in a Layer 3 header. It is proprietary and only supported by Cisco switches. This traffic may be routed across networks.

RSPAN

Vectra sensors DO support VLAN tags within VLAN traffic (known as Q-in-Q). If RSPAN is used to encapsulate VLAN tagged traffic it is likely that no further action is required, however, the traffic must arrive at the sensor with no more than two VLAN tags.

It may be required that the switch be configured to strip the outer layer of VLAN tag prior to presenting the traffic to the Sensor. The switch vendor should be engaged to validate the configuration and ensure that there are no compatibility or performance issues associated with this configuration.

ERSPAN

Vectra Sensors support ERSPAN as of v9.10.

You can enable ERSPAN encapsulation under Configuration → COVERAGE → Data Sources. Visit Encapsulation Endpoints (GRE, ERSPAN, GENEVE, VXLAN) for configuration assistance.