hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures ERSPAN on Router R1 to…
An engineer configures ERSPAN on Router R1 to monitor traffic from VLAN 30 to a collector at 192.168.1.100. The router has multiple VRFs: VRF A and VRF B. The source interface Gi0/0/0 is in VRF A. The collector is in VRF B. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 2 ip address 192.168.1.100 origin ip address 10.0.0.1. The collector is reachable via a route in VRF B. The router has a route-leaking configuration between VRFs. The collector receives no traffic. What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ERSPAN session must be configured with the 'vrf' keyword under the destination to use VRF B.
ERSPAN uses the global routing table by default to route the encapsulated packets to the destination IP. If the source interface is in a VRF, the mirrored traffic is still sent using the global routing table unless the ERSPAN session is configured with a VRF. The destination IP 192.168.1.100 is in VRF B, but the global routing table may not have a route to it. The route-leaking between VRFs does not affect the ERSPAN process because the encapsulated packet is sourced from the global routing table. The fix is to configure the ERSPAN session with the 'vrf' keyword under the destination to specify the VRF. Alternatively, the source IP must be in the same VRF as the destination. The correct root cause is that the ERSPAN session does not specify the VRF, so it uses the global table, which has no route to the collector.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ERSPAN session must be configured with the 'vrf' keyword under the destination to use VRF B.
Why this is correct
Without the VRF keyword, ERSPAN uses the global routing table, which lacks a route to the collector in VRF B.
- ✗
The source interface is in VRF A, but the ERSPAN source IP must be in the same VRF as the destination.
Why it's wrong here
The source IP is in the global table by default; the issue is the routing table used for the destination.
- ✗
The route-leaking configuration is incorrect, preventing reachability between VRFs.
Why it's wrong here
Route-leaking may be correct, but ERSPAN does not use leaked routes unless the VRF is specified.
- ✗
The ERSPAN session ID 2 conflicts with a VRF ID.
Why it's wrong here
There is no such conflict.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.