Encapsulated Remote Switched Port Analyzer (ERSPAN) is a traffic mirroring method that enables the mirrored traffic to be encapsulated in Generic Routing Encapsulation (GRE).

To enable an ERSPAN interface in your USM Anywhere Sensor

1. Open your virtualization management console and connect to the USM Anywhere Sensor Virtual Machine (VM).

   Alternatively, you can open an SSH session to the sensor VM. When using an SSH session, the default username is sysadmin.

   Important: If you are accessing a Microsoft Azure Sensor through SSH and you specified a username other than the default (sysadmin) for SSH access for the sensor VM, you must use the following commands at the command line to "sudo up" and access the sensor console:

   # sudo su –
   # su sysadmin

2. From the System Menu, select Network Configuration and press Enter.
3. Click Configure ERSPAN Interface.
4. Enter the IP address for this interface.
ERSPAN must use your sensor's eth1 IP address for its interface. If your sensor's eth1 is already used by another resource, you must reconfigure that resource to use eth2 or eth3.
5. Click OK.
6. Enter a netmask range for this configuration.
When setting up this netmask, ensure that it does not conflict with the settings for eth0 and the admin interface netmask. If both interfaces are in the same subnet, AT&T Cybersecurity recommends that you use 255.255.255.255 for this netmask instead.
7. Click OK.

8. Once you receive confirmation that the ERSPAN interface has been enabled, refer to the Configuring ERSPAN section of the vendor website to continue the configuration.