Encapsulated Remote Switched Port Analyzer (ERSPAN) is a traffic mirroring method that allows for the mirrored traffic to be encapsulated in Generic Routing Encapsulation (GRE).
To enable an ERSPAN interface in your USM Anywhere Sensor
Open your virtualization management console and connect to the USM Anywhere Sensor Virtual Machine (VM).
Alternatively, you can open an SSH session to the sensor VM. When using an SSH session, the default username is sysadmin.
Important: If you are accessing a Microsoft Azure Sensor through SSH and you specified a username other than the default (sysadmin) for SSH access for the sensor VM, you must use the following commands at the command line to "sudo up" and access the sensor console:
# sudo su –
# su sysadmin
- From the System Menu, select Network Configuration and press Enter.
- Click Configure ERSPAN Interface.
- Enter the IP address for this interface.
- Click OK.
- Enter a netmask range for this configuration.
- Click OK.
Once you receive confirmation that the ERSPAN interface has been enabled, refer to the Configuring ERSPAN section of the vendor website to continue the configuration.