300-410 SPAN, RSPAN, and ERSPAN — Timed 20 Questions

Question 1

A network engineer configures SPAN on a Cisco Catalyst switch to monitor traffic between two hosts. The engineer configures the source interface as GigabitEthernet0/1 and the destination interface as GigabitEthernet0/2. After the configuration, the engineer notices that the monitored traffic is not being forwarded to the destination port. What is the most likely cause?

Accepted Answer

The destination port is in a blocking state due to Spanning Tree Protocol.. SPAN destination ports must be configured with the 'spanning-tree portfast' command to avoid being blocked by Spanning Tree Protocol (STP). Without this, the destination port may remain in a blocking state.

Answer

The destination port is not in the same VLAN as the source port.

Answer

The destination port is configured as a trunk port.

Answer

The source interface is not in the same VLAN as the destination interface.

Question 2

An engineer configures RSPAN on a Cisco switch to monitor traffic from VLAN 10 across multiple switches. The engineer creates an RSPAN VLAN (VLAN 100) on the source switch and configures the source as VLAN 10. On the remote switch, the engineer configures the destination port as GigabitEthernet0/1 in VLAN 100. However, the destination port does not forward any monitored traffic. What is the most likely cause?

Accepted Answer

The RSPAN VLAN is not allowed on the trunk links between the switches.. RSPAN requires that the RSPAN VLAN be allowed on all trunk links between the source and destination switches. If the RSPAN VLAN is not allowed on the trunk, the traffic will not reach the destination.

Answer

The destination port is configured as an access port in VLAN 100.

Answer

The source switch does not have the RSPAN VLAN configured as a remote-span VLAN.

Answer

The destination port is not configured with 'monitor session' on the remote switch.

Question 3

A network engineer is troubleshooting an ERSPAN configuration where traffic from a source router is being sent to a remote monitoring server. The engineer configures an ERSPAN source session on Router A to capture traffic on GigabitEthernet0/0 and send it to the IP address 10.1.1.100. The monitoring server does not receive any packets. The engineer verifies that IP connectivity exists between Router A and the server. What is the most likely cause?

Accepted Answer

The ERSPAN session is missing a tunnel interface configuration.. ERSPAN requires a tunnel interface to encapsulate the monitored traffic. Without configuring a tunnel interface, the ERSPAN session cannot encapsulate the packets for transport to the remote destination.

Answer

The monitoring server is not listening on the correct UDP port.

Answer

The source interface is not in the same subnet as the destination IP.

Answer

The ERSPAN session is configured with the wrong source IP address.

Question 4

An engineer configures a local SPAN session on a Cisco switch to monitor all traffic on VLAN 20. The engineer uses the command 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface GigabitEthernet0/3'. The engineer connects a laptop to GigabitEthernet0/3 and runs a packet capture, but sees only traffic from the switch itself, not from other devices in VLAN 20. What is the most likely cause?

Accepted Answer

The SPAN session is configured to monitor only ingress traffic by default.. By default, SPAN monitors only ingress traffic on the source VLAN. To capture both directions, the command must specify 'both' for the source. The default is 'rx' only.

Answer

The destination port is in a different VLAN than the source VLAN.

Answer

The switch does not support SPAN on VLANs.

Answer

The laptop is not configured to accept tagged traffic.

Question 5

A network engineer configures an RSPAN session on Switch A to monitor traffic from interface GigabitEthernet0/1 and sends it to Switch B. The engineer creates RSPAN VLAN 50 on both switches and configures the trunk between them to allow VLAN 50. On Switch B, the engineer configures the destination port as GigabitEthernet0/2 in VLAN 50. The engineer notices that the destination port is not forwarding any traffic. What should the engineer check first?

Accepted Answer

Verify that the RSPAN VLAN is configured with the 'remote-span' command on both switches.. RSPAN requires that the RSPAN VLAN be configured with the 'remote-span' command on all switches that participate. Without this, the VLAN may not be treated as an RSPAN VLAN and traffic may not be forwarded correctly.

Answer

Check that the destination port is not in a shutdown state.

Answer

Ensure that the source interface is not configured with 'no monitor session'.

Answer

Confirm that the trunk between switches is configured as a dot1q trunk.

Question 6

An engineer configures ERSPAN on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 192.168.1.100. The engineer configures the ERSPAN session with a tunnel source of 10.0.0.1 and a tunnel destination of 192.168.1.100. The monitoring server receives no packets. The engineer pings 192.168.1.100 from the router and succeeds. What is the most likely cause?

Accepted Answer

The monitoring server does not have a route to the tunnel source IP 10.0.0.1.. ERSPAN uses GRE encapsulation, and the tunnel destination must be the IP address of the monitoring server that can decapsulate GRE. However, the tunnel source IP must be reachable from the server; if the server does not have a route back to the tunnel source, the encapsulated packets may be dropped.

Answer

The ERSPAN session is configured with the wrong direction.

Answer

The router does not support ERSPAN.

Answer

The monitoring server is not listening on the correct TCP port.

Question 7

A network engineer configures a SPAN session on a Cisco switch to monitor traffic on interface GigabitEthernet0/1 and sends it to interface GigabitEthernet0/2. The engineer notices that the destination port is up but does not forward any traffic. The engineer checks the configuration and sees that the destination port is configured as a trunk port. What is the most likely cause?

Accepted Answer

The destination port is configured as a trunk port instead of an access port.. SPAN destination ports should be access ports, not trunk ports. If a trunk port is used as a destination, the switch may not forward the monitored traffic correctly because the port expects tagged traffic.

Answer

The source interface is in a different VLAN than the destination interface.

Answer

The SPAN session is configured with the 'rx' direction only.

Answer

The destination port is not in the same VLAN as the source interface.

Question 8

An engineer configures an RSPAN session on a Cisco switch to monitor traffic from VLAN 30 and send it to a remote switch. The engineer creates RSPAN VLAN 200 on both switches and configures the trunk to allow VLAN 200. On the remote switch, the engineer configures the destination port as GigabitEthernet0/4 in VLAN 200. The engineer notices that the destination port is forwarding traffic, but the traffic is not from the source VLAN 30; instead, it is broadcast traffic from other VLANs. What is the most likely cause?

Accepted Answer

The RSPAN VLAN is also being used for other VLAN traffic due to misconfiguration.. RSPAN VLANs should be used exclusively for RSPAN traffic and should not have any other VLANs mapped to them. If the RSPAN VLAN is also used for other purposes, it may carry unintended traffic.

Answer

The source VLAN is not configured correctly on the source switch.

Answer

The destination port is in the wrong VLAN.

Answer

The trunk is not pruning VLAN 200 correctly.

Question 9

A network engineer configures an ERSPAN session on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 172.16.1.100. The engineer uses the command 'monitor session 1 type erspan-source' and configures the tunnel. The monitoring server receives packets, but the packets contain only the original source and destination IP addresses of the monitored traffic, not the encapsulated GRE headers. What is the most likely cause?

Accepted Answer

The ERSPAN session is misconfigured, causing the router to forward the original packets instead of encapsulated copies.. ERSPAN encapsulates the original packet with a GRE header. If the monitoring server receives packets without GRE encapsulation, it means the router is not encapsulating the traffic correctly, possibly because the ERSPAN session is not configured with the correct tunnel source or destination.

Answer

The monitoring server is stripping the GRE headers before capturing.

Answer

The ERSPAN session is configured with the 'ip access-group' command that filters the encapsulated traffic.

Answer

The router is not running the correct IOS version that supports ERSPAN.

Question 10

A network engineer runs the following command on switch SW1:

SW1# show monitor session 1
Session 1
---------
Type : Local Session
Source Ports :
    Both : Gi0/1, Gi0/2
Destination Ports : Gi0/3
    Encapsulation : Native
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The SPAN session is monitoring traffic on Gi0/1 and Gi0/2 and sending it to Gi0/3.. The output shows a local SPAN session with source ports Gi0/1 and Gi0/2, and destination port Gi0/3. The destination port is configured with native encapsulation and ingress is disabled, meaning traffic received on the destination port is not forwarded. The session is active and correctly configured.

Answer

The SPAN session is monitoring traffic on Gi0/3 and sending it to Gi0/1 and Gi0/2.

Answer

The SPAN session is using RSPAN because the destination port has ingress disabled.

Answer

The SPAN session is not active because the destination port is not in forwarding state.

Question 11

A network engineer runs the following command on switch SW2:

SW2# show monitor session 2
Session 2
---------
Type : Remote Source Session
Source Ports :
    Both : Gi0/4
Source VLANs :
    RX Only : 100
Destination Ports : Gi0/5
    Encapsulation : Native
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The session is an RSPAN source session, and the mirrored traffic is sent to Gi0/5.. This is a remote source session (RSPAN source session). It monitors source port Gi0/4 and source VLAN 100 (RX only), and sends the mirrored traffic to destination port Gi0/5, which is typically configured as a trunk port carrying the RSPAN VLAN. The session is correctly configured for RSPAN.

Answer

The session is an ERSPAN source session because it monitors VLAN 100.

Answer

The session is a local SPAN session with source VLAN.

Answer

The session is misconfigured because source VLANs cannot be combined with source ports.

Question 12

A network engineer runs the following command on switch SW3:

SW3# show monitor session 3
Session 3
---------
Type : Remote Destination Session
Source Ports :
    RX Only : Gi0/6
Destination Ports : Gi0/7
    Encapsulation : Native
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The session is an RSPAN destination session, and traffic from the RSPAN VLAN is received on Gi0/6 and sent to Gi0/7.. This is an RSPAN destination session. It receives mirrored traffic from the RSPAN VLAN via source port Gi0/6 (RX only) and sends it to destination port Gi0/7 for analysis. The source port is typically a trunk port carrying the RSPAN VLAN.

Answer

The session is an ERSPAN destination session because it uses RX only.

Answer

The session is a local SPAN session with source port Gi0/6.

Answer

The session is misconfigured because the destination port has ingress disabled.

Question 13

A network engineer runs the following command on router R2:

R2# show monitor session 4
Session 4
---------
Type : ERSPAN Source Session
Status : Admin Enabled
Source Ports :
    Both : Gi0/0
Destination IP : 192.168.1.10
Origin IP : 10.0.0.2
ERSPAN ID : 100

Based on this output, which statement is correct?

Accepted Answer

The ERSPAN session is mirroring traffic from Gi0/0 to IP address 192.168.1.10 using ERSPAN ID 100.. This is an ERSPAN source session. It mirrors traffic from source port Gi0/0 and encapsulates it with an ERSPAN header, sending it to destination IP 192.168.1.10 with origin IP 10.0.0.2 and ERSPAN ID 100. The session is administratively enabled.

Answer

The ERSPAN session is mirroring traffic from IP 192.168.1.10 to Gi0/0.

Answer

The ERSPAN session is using RSPAN encapsulation.

Answer

The ERSPAN session is disabled because the status is 'Admin Enabled'.

Question 14

A network engineer runs the following command on router R3:

R3# show monitor session 5
Session 5
---------
Type : ERSPAN Destination Session
Status : Admin Enabled
Source IP : 10.0.0.2
Destination Ports : Gi0/1
    Encapsulation : Native
    Ingress : Disabled
ERSPAN ID : 100

Based on this output, which statement is correct?

Accepted Answer

The ERSPAN destination session receives traffic from source IP 10.0.0.2 and sends it to Gi0/1.. This is an ERSPAN destination session. It receives ERSPAN-encapsulated traffic from source IP 10.0.0.2 with ERSPAN ID 100, decapsulates it, and sends the original mirrored traffic to destination port Gi0/1. The session is administratively enabled.

Answer

The ERSPAN destination session sends traffic to source IP 10.0.0.2.

Answer

The session is an RSPAN destination session because it uses a destination port.

Answer

The session is misconfigured because the destination port has ingress disabled.

Question 15

A network engineer runs the following command on switch SW4:

SW4# show monitor session 6
Session 6
---------
Type : Local Session
Source Ports :
    Both : Gi0/8, Gi0/9
Destination Ports : Gi0/10
    Encapsulation : Native
    Ingress : Enabled

Based on this output, which statement is correct?

Accepted Answer

The SPAN session is configured correctly and will forward traffic received on Gi0/10 into the network.. This is a local SPAN session with source ports Gi0/8 and Gi0/9, and destination port Gi0/10. The destination port has ingress enabled, which means traffic received on Gi0/10 will be processed and forwarded by the switch. This is unusual because SPAN destination ports typically have ingress disabled to prevent loops and forwarding of mirrored traffic. This configuration can cause network issues.

Answer

The SPAN session is misconfigured because source ports cannot be monitored in both directions.

Answer

The SPAN session is using RSPAN because the destination port has ingress enabled.

Answer

The SPAN session is disabled because the destination port has ingress enabled.

Question 16

A network engineer runs the following command on switch SW5:

SW5# show monitor session 7
Session 7
---------
Type : Local Session
Source Ports :
    Both : Gi0/11
Destination Ports : Gi0/12
    Encapsulation : Replicate
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The SPAN session will replicate the original VLAN tag on the mirrored traffic sent to Gi0/12.. This is a local SPAN session with source port Gi0/11 and destination port Gi0/12. The encapsulation is set to 'Replicate', which means the mirrored traffic retains its original VLAN tag. This is typical when the destination port is a trunk port and the analyzer expects tagged traffic.

Answer

The SPAN session will strip the VLAN tag from the mirrored traffic.

Answer

The SPAN session is using RSPAN because the encapsulation is set to Replicate.

Answer

The SPAN session is misconfigured because encapsulation Replicate is not supported.

Question 17

A network engineer runs the following command on switch SW6:

SW6# show monitor session 8
Session 8
---------
Type : Remote Source Session
Source Ports :
    Both : Gi0/13
Source VLANs :
    TX Only : 200
Destination Ports : Gi0/14
    Encapsulation : Dot1q
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The RSPAN source session sends mirrored traffic to Gi0/14 with a Dot1q tag.. This is an RSPAN source session. It monitors source port Gi0/13 and source VLAN 200 (TX only), and sends the mirrored traffic to destination port Gi0/14 with Dot1q encapsulation. The Dot1q encapsulation indicates that the destination port is a trunk port carrying the RSPAN VLAN. The session is correctly configured.

Answer

The RSPAN source session sends mirrored traffic to Gi0/14 without any VLAN tag.

Answer

The session is an ERSPAN source session because it uses Dot1q encapsulation.

Answer

The session is misconfigured because source VLANs cannot be TX only.

Question 18

A network engineer runs the following command on router R4:

R4# show monitor session 9
Session 9
---------
Type : ERSPAN Source Session
Status : Admin Disabled
Source Ports :
    Both : Gi0/2
Destination IP : 192.168.2.20
Origin IP : 10.0.0.3
ERSPAN ID : 200

Based on this output, which statement is correct?

Accepted Answer

The ERSPAN session is configured but not currently active because it is administratively disabled.. This is an ERSPAN source session that is administratively disabled. The configuration is present but not active. To enable it, the engineer must use the 'no shutdown' command under the session configuration.

Answer

The ERSPAN session is actively mirroring traffic from Gi0/2 to 192.168.2.20.

Answer

The ERSPAN session is using RSPAN because the status is disabled.

Answer

The ERSPAN session is misconfigured because the origin IP is missing.

Question 19

Consider the following partial configuration on a Cisco IOS-XE switch:

monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Accepted Answer

It copies all traffic received and transmitted on GigabitEthernet1/0/1 to GigabitEthernet1/0/2.. This configures a local SPAN session that copies traffic from GigabitEthernet1/0/1 (both ingress and egress) to GigabitEthernet1/0/2 for monitoring.

Answer

It copies only ingress traffic from GigabitEthernet1/0/1 to GigabitEthernet1/0/2.

Answer

It copies only egress traffic from GigabitEthernet1/0/1 to GigabitEthernet1/0/2.

Answer

It copies traffic from GigabitEthernet1/0/2 to GigabitEthernet1/0/1.

Question 20

Given the configuration:

monitor session 2 source vlan 10-12 both
monitor session 2 destination interface GigabitEthernet1/0/3

Which statement is true?

Accepted Answer

Traffic from all ports in VLANs 10, 11, and 12 is copied to GigabitEthernet1/0/3.. This configures a VLAN-based SPAN session that monitors all traffic on VLANs 10, 11, and 12 and sends a copy to GigabitEthernet1/0/3.

Answer

Only traffic from the access ports in VLAN 10 is copied.

Answer

The destination port must be in VLAN 10.

Answer

The destination port will become a SPAN destination and cannot be used for normal traffic.