350-401 · Question #648
Refer to the exhibit. An engineer must configure an ERSPAN session with the remote end of the session 10.10.0.1. Which commands must be added to complete the configuration?
The correct answer is A. Device(config)#monitor session 1 type erspan-source. ERSPAN Session Configuration Explanation Option A is correct because when configuring ERSPAN (Encapsulated Remote SPAN), the device that captures and sends mirrored traffic toward the remote destination (10.10.0.1) must be configured as an erspan-source session, which monitors lo
Question
Exhibits
Options
- ADevice(config)#monitor session 1 type erspan-source
- BDevice(config)#monitor session 1 type erspan-source
- CDevice(config)#monitor session 1 type erspan-destination
- DDevice(config)#monitor session 1 type erspan-source
How the community answered
(31 responses)- A71% (22)
- B3% (1)
- C6% (2)
- D19% (6)
Explanation
ERSPAN Session Configuration Explanation
Option A is correct because when configuring ERSPAN (Encapsulated Remote SPAN), the device that captures and sends mirrored traffic toward the remote destination (10.10.0.1) must be configured as an erspan-source session, which monitors local interfaces and encapsulates the traffic in GRE to forward it to the remote IP. Option C is incorrect because erspan-destination is used on the receiving end of the session (the device at 10.10.0.1), not the sending/source device - since the question asks about configuring the device that sends traffic to 10.10.0.1, destination type would be backwards. Options B and D appear identical to A in text, but in the actual exhibit context, they likely contain incorrect sub-commands (such as wrong destination IP, missing erspan-id, or incorrect source interface configuration) that make them invalid completions of the shown configuration.
Memory Tip: Think of ERSPAN like mailing a package - the source device sends the mirrored traffic (like a sender), and the destination device receives it (like a recipient). If you're pointing traffic toward a remote IP, you are always the source.
Topics
Community Discussion
No community discussion yet for this question.

