A network administrator is attempting to troubleshoot a connectivity issue between a group of users and a particular server. The administrator needs to examine the packets over a period of time from their desktop; however, the administrator is not directly connected to the AOS-CX switch involved with the traffic flow.
What is correct regarding the ERSPAN session that needs to be established on an AOS-CX switch? (Choose two.)
To establish an ERSPAN session on an AOS-CX switch, the administrator's desktop must be specified as the destination for the captured packets because the administrator is not directly connected to the switch involved with the traffic flow. This facilitates direct monitoring of the captured traffic on the administrator's desktop. Furthermore, ERSPAN employs the GRE (Generic Routing Encapsulation) protocol to encapsulate the mirrored traffic, making it routable across the network. Therefore, the correct answers are specifying the administrator's desktop as the destination and using GRE for encapsulation.
In AOS CX the remote mirroring is done using a tunnel interface, so the Mirror source and destination must be configured on each Switch. On the source Switch, the source interface (from where the traffic is mirrored) and destination interface (the tunnel interface to where the traffic is sent to). In the destination Switch, the source interface (which would be the tunnel interface (receiving the traffic from the source switch tunnel)) and the destination would be the client where Wireshark enabled client is connected. So, the answer is A & C.
You said it yourself. Target is the client itself, not the switch it is connected to. It's B&C.
Acording to student guide, page 149. "AOS switches support mirroring to other AOS switches. AOS-CS switches, however, do not support this feature. Instead, the remote mirroring must be to a device that supports it, like Wireshark" Thats why, I think that the answer is B and C
AOS-CX switches also support remote port mirroring, in which the switch forwards the mirrored packets to a destination device. The switch achieves this by encapsulating the mirrored packets in a GRE header that uses the remote switch’s IP address as the destination. The remote, or destination, switch is configured to decapsulate traffic from this GRE tunnel and to forward the traffic out an exit port (see the previous slide on setting up local mirroring).
A&C are correct per the study guide
Page 159 Study Guide: ERSPAN is an acronym that stands for encapsulated remote switched port analyzer . ERSPAN mirrors traffic on one or more source ports and forwards the mirrored traffic to a destination on a remote device. The traffic is encapsulated in generic routing encapsulation (GRE) and is, therefore, routable across a layer 3 network between the source switch and the destination device, like a packet sniffer, e.g. Wireshark [Aruba Networks] In addition in page 160 it says: Note: AOS switches support mirroring to other AOS switches. AOS- CX switches, however, do not support this feature. Instead, the remote mirroring must be to a device that supports it, like Wireshark. [Aruba Networks] So, definetely B&C
BC based on Airheads community
B and C, I found a guide for Aruba - ERSPAN solution with a workstation as a destination address. https://community.arubanetworks.com/community-home/librarydocuments/viewdocument?DocumentKey=43a0aad6-4f7a-4cd2-83a0-3aa846accefd&CommunityKey=2fd943a6-8898-4dbe-915f-4f09e4d3c317&tab=librarydocuments
I have to correct myself: B&C look correct, as per my review of the documentation: "The traffic is encapsulated in generic routing encapsulation (GRE) and is, therefore, routable across a layer 3 network between the source switch and the destination device, like a packet sniffer, e.g. Wireshark."
The question clearly says "the administrator is not directly connected to the AOS-CX switch" how come option A comes in. Answer is B and C.
GRE to the admin's wireshark directly
GRE tunnel to the admin's desktop directly
https://community.arubanetworks.com/blogs/esupport1/2021/06/28/arubaos-cx-send-mirrored-traffic-to-workstation-with-erspan So BC
BC is correct.
the desktop of administrator is in other switch and the ERSPAN can send it traficc to the desktop administrator.
BC. ERSPAN uses layer 3, so can send traffic directly to a device. https://community.arubanetworks.com/community-home/librarydocuments/viewdocument?DocumentKey=43a0aad6-4f7a-4cd2-83a0-3aa846accefd&CommunityKey=2fd943a6-8898-4dbe-915f-4f09e4d3c317&tab=librarydocuments
BC correct options: ERSPAN is an acronym that stands for encapsulated remote switched port analyzer. ERSPAN mirrors traffic on one or more source ports and forwards the mirrored traffic to a destination on a remote device. The traffic is encapsulated in generic routing encapsulation (GRE) and is, therefore, routable across a layer 3 network between the source switch and the destination device, like a packet sniffer, e.g. Wireshark
Learning book ACSP chap "Network Analytics Engine - Remote traffic Mirroring : ERSPAN" : "The traffic is encapsulated in generic routing encapsulation (GRE) and is, therefore, routable across layer 3 network between the source switch and the destination device, like a packet sniffer, for exemple Wireshark" "AOS switches support mirroring to other AOS switches. AOS-CX switches, however, do not support this feature. Instead, the remote mirroring must be to a device that support it, like Wireshark"
error, i wan to say BC