hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures ERSPAN on Router R1 to…
An engineer configures ERSPAN on Router R1 to monitor traffic from VLAN 100 to a remote collector at 192.168.10.10 via a GRE tunnel. The source interface is GigabitEthernet0/0/0. After configuration, the collector receives no mirrored packets. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 100 ip address 192.168.10.10 origin ip address 10.1.1.1 no shutdown. R1's routing table shows a default route via 10.1.1.2, and a static route to 192.168.10.0/24 via 10.1.1.2. The tunnel interface Tunnel0 is up/up with IP 10.1.1.1/30. What is the most likely root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The GRE tunnel interface is used for the ERSPAN source IP, causing a recursive routing loop because the destination IP is routed via the tunnel's next-hop.
ERSPAN encapsulates mirrored packets in GRE with a destination IP of the collector. The router must have a route to the collector IP, but the encapsulated packets use the routing table of the default VRF. If the destination IP is reachable via a route that points to a next-hop that is not directly connected, the router may attempt to use the GRE tunnel interface itself, causing a recursive routing loop. The GRE tunnel interface IP (10.1.1.1) is used as the source, but the destination 192.168.10.10 is routed via 10.1.1.2, which is the tunnel's next-hop. This creates a recursion: the packet is encapsulated with destination 192.168.10.10, then routed, which again matches the tunnel, leading to a loop and packet drop. The fix is to use a separate source IP or ensure the route to the collector does not point back through the tunnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The monitor session is administratively down due to a missing 'no shutdown' command.
Why it's wrong here
The configuration shows 'no shutdown' is present.
- ✗
The ERSPAN destination IP address is in a different VRF that is not reachable from the source VRF.
Why it's wrong here
There is no VRF configuration mentioned; the routing table shows a default route, implying global routing table.
- ✓
The GRE tunnel interface is used for the ERSPAN source IP, causing a recursive routing loop because the destination IP is routed via the tunnel's next-hop.
Why this is correct
The source IP 10.1.1.1 is the tunnel interface IP, and the destination 192.168.10.10 is routed via 10.1.1.2, which is the tunnel's next-hop. This recursion causes the encapsulated packet to be dropped.
- ✗
The ERSPAN session ID 100 conflicts with an existing GRE key on the tunnel.
Why it's wrong here
ERSPAN ID is a session identifier, not a GRE key; no conflict is indicated.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.