Exam HPE6-A73 topic 1 question 18 discussion

In AOS CX the remote mirroring is done using a tunnel interface, so the Mirror source and destination must be configured on each Switch. On the source Switch, the source interface (from where the traffic is mirrored) and destination interface (the tunnel interface to where the traffic is sent to). In the destination Switch, the source interface (which would be the tunnel interface (receiving the traffic from the source switch tunnel)) and the destination would be the client where Wireshark enabled client is connected. So, the answer is A & C.

Acording to student guide, page 149. "AOS switches support mirroring to other AOS switches. AOS-CS switches, however, do not support this feature. Instead, the remote mirroring must be to a device that supports it, like Wireshark" Thats why, I think that the answer is B and C

In ERSPAN, the traffic is encapsulated in GRE and is routed across layer 3 network between the source switch and the destination device, like a packet sniffer. so it B&C. A&C would be correct if we talk about remote port mirroring not ERSPAN

AOS-CX don't support switch-to-switch mirroring. The answer is B and C

Learning book ACSP chap "Network Analytics Engine - Remote traffic Mirroring : ERSPAN" : "The traffic is encapsulated in generic routing encapsulation (GRE) and is, therefore, routable across layer 3 network between the source switch and the destination device, like a packet sniffer, for exemple Wireshark" "AOS switches support mirroring to other AOS switches. AOS-CX switches, however, do not support this feature. Instead, the remote mirroring must be to a device that support it, like Wireshark"

BC correct options: ERSPAN is an acronym that stands for encapsulated remote switched port analyzer. ERSPAN mirrors traffic on one or more source ports and forwards the mirrored traffic to a destination on a remote device. The traffic is encapsulated in generic routing encapsulation (GRE) and is, therefore, routable across a layer 3 network between the source switch and the destination device, like a packet sniffer, e.g. Wireshark

BC. ERSPAN uses layer 3, so can send traffic directly to a device. https://community.arubanetworks.com/community-home/librarydocuments/viewdocument?DocumentKey=43a0aad6-4f7a-4cd2-83a0-3aa846accefd&CommunityKey=2fd943a6-8898-4dbe-915f-4f09e4d3c317&tab=librarydocuments

AOS-CX switches also support remote port mirroring, in which the switch forwards the mirrored packets to a destination device. The switch achieves this by encapsulating the mirrored packets in a GRE header that uses the remote switch’s IP address as the destination. The remote, or destination, switch is configured to decapsulate traffic from this GRE tunnel and to forward the traffic out an exit port (see the previous slide on setting up local mirroring).

Page 159 Study Guide: ERSPAN is an acronym that stands for encapsulated remote switched port analyzer . ERSPAN mirrors traffic on one or more source ports and forwards the mirrored traffic to a destination on a remote device. The traffic is encapsulated in generic routing encapsulation (GRE) and is, therefore, routable across a layer 3 network between the source switch and the destination device, like a packet sniffer, e.g. Wireshark [Aruba Networks] In addition in page 160 it says: Note: AOS switches support mirroring to other AOS switches. AOS- CX switches, however, do not support this feature. Instead, the remote mirroring must be to a device that supports it, like Wireshark. [Aruba Networks] So, definetely B&C

the desktop of administrator is in other switch and the ERSPAN can send it traficc to the desktop administrator.

B and C, I found a guide for Aruba - ERSPAN solution with a workstation as a destination address. https://community.arubanetworks.com/community-home/librarydocuments/viewdocument?DocumentKey=43a0aad6-4f7a-4cd2-83a0-3aa846accefd&CommunityKey=2fd943a6-8898-4dbe-915f-4f09e4d3c317&tab=librarydocuments

BC is correct.

BC based on Airheads community

https://community.arubanetworks.com/blogs/esupport1/2021/06/28/arubaos-cx-send-mirrored-traffic-to-workstation-with-erspan So BC

GRE tunnel to the admin's desktop directly

GRE to the admin's wireshark directly

The question clearly says "the administrator is not directly connected to the AOS-CX switch" how come option A comes in. Answer is B and C.