Merge pull request #620 from jack9603301/T3030

tunnel: T3030: Add erspan protocol support

11 files changed, 679 insertions, 133 deletions

diff --git a/data/configd-include.json b/data/configd-include.json
index 751d8e012..3da80603f 100644
--- a/data/configd-include.json
+++ b/data/configd-include.json
@@ -21,6 +21,7 @@
 "interfaces-pppoe.py",
 "interfaces-pseudo-ethernet.py",
 "interfaces-tunnel.py",
+"interfaces-erspan.py",
 "interfaces-vxlan.py",
 "interfaces-wireguard.py",
 "interfaces-wireless.py",
diff --git a/interface-definitions/include/tunnel-local-remote-ip.xml.i b/interface-definitions/include/tunnel-local-remote-ip.xml.i
new file mode 100644
index 000000000..85c20f482
--- /dev/null
+++ b/interface-definitions/include/tunnel-local-remote-ip.xml.i
@@ -0,0 +1,37 @@
+<!-- included start from tunnel-local-remote-ip.xml.i -->
+<leafNode name="local-ip">
+  <properties>
+    <help>Local IP address for this tunnel</help>
+    <valueHelp>
+      <format>ipv4</format>
+      <description>Local IPv4 address for this tunnel</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ipv6</format>
+      <description>Local IPv6 address for this tunnel</description>
+    </valueHelp>
+    <completionHelp>
+      <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
+    </completionHelp>
+    <constraint>
+      <validator name="ip-address"/>
+    </constraint>
+  </properties>
+</leafNode>
+<leafNode name="remote-ip">
+  <properties>
+    <help>Remote IP address for this tunnel</help>
+    <valueHelp>
+      <format>ipv4</format>
+      <description>Remote IPv4 address for this tunnel</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ipv6</format>
+      <description>Remote IPv6 address for this tunnel</description>
+    </valueHelp>
+    <constraint>
+      <!-- does it need fixing/changing to be more restrictive ? -->
+      <validator name="ip-address"/>
+    </constraint>
+  </properties>
+</leafNode>
diff --git a/interface-definitions/include/tunnel-parameters-ip.xml.i b/interface-definitions/include/tunnel-parameters-ip.xml.i
new file mode 100644
index 000000000..c304bd3ff
--- /dev/null
+++ b/interface-definitions/include/tunnel-parameters-ip.xml.i
@@ -0,0 +1,49 @@
+<!-- included start from tunnel-parameters-ip.xml.i -->
+<node name="ip">
+  <properties>
+    <help>IPv4 specific tunnel parameters</help>
+  </properties>
+  <children>
+    <leafNode name="ttl">
+      <properties>
+        <help>Time to live field</help>
+        <valueHelp>
+          <format>0-255</format>
+          <description>Time to live (default 255)</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 0-255"/>
+        </constraint>
+        <constraintErrorMessage>TTL must be between 0 and 255</constraintErrorMessage>
+      </properties>
+      <defaultValue>255</defaultValue>
+    </leafNode>
+    <leafNode name="tos">
+      <properties>
+        <help>Type of Service (TOS)</help>
+        <valueHelp>
+          <format>0-99</format>
+          <description>Type of Service (TOS)</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 0-99"/>
+        </constraint>
+        <constraintErrorMessage>TOS must be between 0 and 99</constraintErrorMessage>
+      </properties>
+      <defaultValue>inherit</defaultValue>
+    </leafNode>
+    <leafNode name="key">
+      <properties>
+        <help>Tunnel key</help>
+        <valueHelp>
+          <format>u32</format>
+          <description>Tunnel key</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 0-4294967295"/>
+        </constraint>
+        <constraintErrorMessage>key must be between 0-4294967295</constraintErrorMessage>
+      </properties>
+    </leafNode>
+  </children>
+</node>
diff --git a/interface-definitions/interfaces-erspan.xml.in b/interface-definitions/interfaces-erspan.xml.in
new file mode 100644
index 000000000..afc29a658
--- /dev/null
+++ b/interface-definitions/interfaces-erspan.xml.in
@@ -0,0 +1,104 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="interfaces">
+    <children>
+      <tagNode name="erspan" owner="${vyos_conf_scripts_dir}/interfaces-erspan.py">
+        <properties>
+          <help>Encapsulated Remote SPAN over GRE and IPv4/IPv6 Tunnel Interface</help>
+          <priority>310</priority>
+          <constraint>
+            <regex>^ersp[0-9]+$</regex>
+          </constraint>
+          <constraintErrorMessage>ERSPAN tunnel interface must be named erspN</constraintErrorMessage>
+          <valueHelp>
+            <format>erspN</format>
+            <description>ERSPAN Tunnel interface name</description>
+          </valueHelp>
+        </properties>
+        <children>
+          #include <include/interface-description.xml.i>
+          #include <include/interface-disable.xml.i>
+          #include <include/interface-disable-link-detect.xml.i>
+          #include <include/interface-mtu-64-8024.xml.i>
+          #include <include/tunnel-local-remote-ip.xml.i>
+          <leafNode name="encapsulation">
+            <properties>
+              <help>Encapsulation of this tunnel interface</help>
+              <completionHelp>
+                <list>erspan ip6erspan</list>
+              </completionHelp>
+              <valueHelp>
+                <format>erspan</format>
+                <description>Generic Routing Encapsulation</description>
+              </valueHelp>
+              <valueHelp>
+                <format>ip6erspan</format>
+                <description>Generic Routing Encapsulation bridge interface</description>
+              </valueHelp>
+              <constraint>
+                <regex>^(erspan|ip6erspan)$</regex>
+              </constraint>
+              <constraintErrorMessage>Invalid encapsulation, must be one of: erspan, ip6erspan</constraintErrorMessage>
+            </properties>
+          </leafNode>
+          <node name="parameters">
+            <properties>
+              <help>ERSPAN Tunnel parameters</help>
+            </properties>
+            <children>
+              #include <include/tunnel-parameters-ip.xml.i>
+              <leafNode name="version">
+                <properties>
+                  <help>ERSPAN version number setting(default:1)</help>
+                  <constraint>
+                    <validator name="numeric" argument="--range 1-2"/>
+                  </constraint>
+                  <constraintErrorMessage>The version number of ERSPAN must be 1 or 2</constraintErrorMessage>
+                </properties>
+                <defaultValue>1</defaultValue>
+              </leafNode>
+              <leafNode name="direction">
+                <properties>
+                  <help>specifies the ERSPAN mirrored traffic's direction</help>
+                  <completionHelp>
+                    <list>ingress egress</list>
+                  </completionHelp>
+                  <valueHelp>
+                    <format>ingress</format>
+                    <description>Mirror ingress direction</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>egress</format>
+                    <description>Mirror egress direction</description>
+                  </valueHelp>
+                  <constraint>
+                    <regex>^(ingress|egress)$</regex>
+                  </constraint>
+                  <constraintErrorMessage>The mirror direction of ERSPAN must be ingress or egress</constraintErrorMessage>
+                </properties>
+              </leafNode>
+              <leafNode name="hwid">
+                <properties>
+                  <help>an unique identifier of an ERSPAN v2 engine within a system</help>
+                  <constraint>
+                    <validator name="numeric" argument="--range 1-1048575"/>
+                  </constraint>
+                  <constraintErrorMessage>ERSPAN hwid must be a number(range:0-1048575)</constraintErrorMessage>
+                </properties>
+              </leafNode>
+              <leafNode name="idx">
+                <properties>
+                  <help>specifies the ERSPAN v1 index field</help>
+                  <constraint>
+                    <validator name="numeric" argument="--range 0-63"/>
+                  </constraint>
+                  <constraintErrorMessage>ERSPAN idx must be a number(range:0-63)</constraintErrorMessage>
+                </properties>
+              </leafNode>
+            </children>
+          </node>
+        </children>
+      </tagNode>
+    </children>
+  </node>
+</interfaceDefinition>
diff --git a/interface-definitions/interfaces-tunnel.xml.in b/interface-definitions/interfaces-tunnel.xml.in
index 7fa847ab0..279c05cca 100644
--- a/interface-definitions/interfaces-tunnel.xml.in
+++ b/interface-definitions/interfaces-tunnel.xml.in
@@ -27,42 +27,7 @@
           </leafNode>
           #include <include/interface-ipv4-options.xml.i>
           #include <include/interface-ipv6-options.xml.i>
-          <leafNode name="local-ip">
-            <properties>
-              <help>Local IP address for this tunnel</help>
-              <valueHelp>
-                <format>ipv4</format>
-                <description>Local IPv4 address for this tunnel</description>
-              </valueHelp>
-              <valueHelp>
-                <format>ipv6</format>
-                <description>Local IPv6 address for this tunnel [NOTICE: unavailable for mGRE tunnels]</description>
-              </valueHelp>
-              <completionHelp>
-                <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
-              </completionHelp>
-              <constraint>
-                <validator name="ip-address"/>
-              </constraint>
-            </properties>
-          </leafNode>
-          <leafNode name="remote-ip">
-            <properties>
-              <help>Remote IP address for this tunnel</help>
-              <valueHelp>
-                <format>ipv4</format>
-                <description>Remote IPv4 address for this tunnel</description>
-              </valueHelp>
-              <valueHelp>
-                <format>ipv6</format>
-                <description>Remote IPv6 address for this tunnel</description>
-              </valueHelp>
-              <constraint>
-                <!-- does it need fixing/changing to be more restrictive ? -->
-                <validator name="ip-address"/>
-              </constraint>
-            </properties>
-          </leafNode>
+          #include <include/tunnel-local-remote-ip.xml.i>
           <leafNode name="source-interface">
             <properties>
               <help>Physical Interface used for underlaying traffic</help>
@@ -175,71 +140,7 @@
               <help>Tunnel parameters</help>
             </properties>
             <children>
-              <node name="ip">
-                <properties>
-                  <help>IPv4 specific tunnel parameters</help>
-                </properties>
-                <children>
-                  <leafNode name="no-pmtu-discovery">
-                    <properties>
-                      <help>Disable path MTU discovery</help>
-                      <valueless/>
-                    </properties>
-                  </leafNode>
-                  <leafNode name="ttl">
-                    <properties>
-                      <help>Time to live (default: 0)</help>
-                      <valueHelp>
-                        <format>0</format>
-                        <description>Copy value from original IP header</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>1-255</format>
-                        <description>Time to Live</description>
-                      </valueHelp>
-                      <constraint>
-                        <validator name="numeric" argument="--range 0-255"/>
-                      </constraint>
-                      <constraintErrorMessage>TTL must be between 0 and 255</constraintErrorMessage>
-                    </properties>
-                    <defaultValue>0</defaultValue>
-                  </leafNode>
-                  <leafNode name="tos">
-                    <properties>
-                      <help>Type of Service (default: 0)</help>
-                      <completionHelp>
-                        <list>inherit</list>
-                      </completionHelp>
-                      <valueHelp>
-                        <format>0</format>
-                        <description>Copy value from original IP header</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>1-99</format>
-                        <description>Type of Service (TOS)</description>
-                      </valueHelp>
-                      <constraint>
-                        <validator name="numeric" argument="--range 0-99"/>
-                      </constraint>
-                      <constraintErrorMessage>TOS must be between 0 and 99</constraintErrorMessage>
-                    </properties>
-                    <defaultValue>0</defaultValue>
-                  </leafNode>
-                  <leafNode name="key">
-                    <properties>
-                      <help>Tunnel key</help>
-                      <valueHelp>
-                        <format>u32</format>
-                        <description>Tunnel key</description>
-                      </valueHelp>
-                      <constraint>
-                        <validator name="numeric" argument="--range 0-4294967295"/>
-                      </constraint>
-                      <constraintErrorMessage>Key must be in range 0-4294967295</constraintErrorMessage>
-                    </properties>
-                  </leafNode>
-                </children>
-              </node>
+              #include <include/tunnel-parameters-ip.xml.i>
               <node name="ipv6">
                 <properties>
                   <help>IPv6 specific tunnel parameters</help>
diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py
index efcf403ce..5a4d14c68 100644
--- a/python/vyos/configverify.py
+++ b/python/vyos/configverify.py
@@ -89,6 +89,49 @@ def verify_vrf(config):
                 'Interface "{ifname}" cannot be both a member of VRF "{vrf}" '
                 'and bridge "{is_bridge_member}"!'.format(**config))
 
+def verify_tunnel(config):
+    """
+    This helper is used to verify the common part of the tunnel
+    """
+    from vyos.template import is_ipv4
+    from vyos.template import is_ipv6
+    
+    if 'encapsulation' not in config:
+        raise ConfigError('Must configure the tunnel encapsulation for '\
+                          '{ifname}!'.format(**config))
+    
+    if 'local_ip' not in config and 'dhcp_interface' not in config:
+        raise ConfigError('local-ip is mandatory for tunnel')
+
+    if 'remote_ip' not in config and config['encapsulation'] != 'gre':
+        raise ConfigError('remote-ip is mandatory for tunnel')
+
+    if {'local_ip', 'dhcp_interface'} <= set(config):
+        raise ConfigError('Can not use both local-ip and dhcp-interface')
+
+    if config['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre', 'ip6erspan']:
+        error_ipv6 = 'Encapsulation mode requires IPv6'
+        if 'local_ip' in config and not is_ipv6(config['local_ip']):
+            raise ConfigError(f'{error_ipv6} local-ip')
+
+        if 'remote_ip' in config and not is_ipv6(config['remote_ip']):
+            raise ConfigError(f'{error_ipv6} remote-ip')
+    else:
+        error_ipv4 = 'Encapsulation mode requires IPv4'
+        if 'local_ip' in config and not is_ipv4(config['local_ip']):
+            raise ConfigError(f'{error_ipv4} local-ip')
+
+        if 'remote_ip' in config and not is_ipv4(config['remote_ip']):
+            raise ConfigError(f'{error_ipv4} remote-ip')
+
+    if config['encapsulation'] in ['sit', 'gre-bridge']:
+        if 'source_interface' in config:
+            raise ConfigError('Option source-interface can not be used with ' \
+                              'encapsulation "sit" or "gre-bridge"')
+    elif config['encapsulation'] == 'gre':
+        if 'local_ip' in config and is_ipv6(config['local_ip']):
+            raise ConfigError('Can not use local IPv6 address is for mGRE tunnels')
+
 def verify_eapol(config):
     """
     Common helper function used by interface implementations to perform
diff --git a/python/vyos/ifconfig/__init__.py b/python/vyos/ifconfig/__init__.py
index 9cd8d44c1..f7b55c9dd 100644
--- a/python/vyos/ifconfig/__init__.py
+++ b/python/vyos/ifconfig/__init__.py
@@ -39,6 +39,8 @@ from vyos.ifconfig.tunnel import IPIP6If
 from vyos.ifconfig.tunnel import IP6IP6If
 from vyos.ifconfig.tunnel import SitIf
 from vyos.ifconfig.tunnel import Sit6RDIf
+from vyos.ifconfig.erspan import ERSpanIf
+from vyos.ifconfig.erspan import ER6SpanIf
 from vyos.ifconfig.wireless import WiFiIf
 from vyos.ifconfig.l2tpv3 import L2TPv3If
 from vyos.ifconfig.macsec import MACsecIf
diff --git a/python/vyos/ifconfig/erspan.py b/python/vyos/ifconfig/erspan.py
new file mode 100755
index 000000000..50230e14a
--- /dev/null
+++ b/python/vyos/ifconfig/erspan.py
@@ -0,0 +1,190 @@
+# Copyright 2019-2020 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# https://developers.redhat.com/blog/2019/05/17/an-introduction-to-linux-virtual-interfaces-tunnels/#erspan
+# http://vger.kernel.org/lpc_net2018_talks/erspan-linux-presentation.pdf
+
+from copy import deepcopy
+
+from netaddr import EUI
+from netaddr import mac_unix_expanded
+from random import getrandbits
+
+from vyos.util import dict_search
+from vyos.ifconfig.interface import Interface
+from vyos.validate import assert_list
+
+@Interface.register
+class _ERSpan(Interface):
+    """
+    _ERSpan: private base class for ERSPAN tunnels
+    """
+    default = {
+        **Interface.default,
+        **{
+            'type': 'erspan',
+        }
+    }
+    definition = {
+        **Interface.definition,
+        **{
+            'section': 'erspan',
+            'prefixes': ['ersp',],
+        },
+    }
+    
+    options = ['local_ip','remote_ip','encapsulation','parameters']
+    
+    def __init__(self,ifname,**config):
+        self.config = deepcopy(config) if config else {}
+        super().__init__(ifname, **self.config)
+    
+    def change_options(self):
+        pass
+    
+    def update(self, config):
+        
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        super().update(config)
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
+    
+    def _create(self):
+        pass
+
+class ERSpanIf(_ERSpan):
+    """
+    ERSpanIf: private base class for ERSPAN Over GRE and IPv4 tunnels
+    """
+    
+    def _create(self):
+        ifname = self.config['ifname']
+        local_ip = self.config['local_ip']
+        remote_ip = self.config['remote_ip']
+        key = self.config['parameters']['ip']['key']
+        version = self.config['parameters']['version']
+        command = f'ip link add dev {ifname} type erspan local {local_ip} remote {remote_ip} seq key {key} erspan_ver {version}'
+        
+        if int(version) == 1:
+            idx=dict_search('parameters.erspan.idx',self.config)
+            if idx:
+                command += f' erspan {idx}'
+        elif int(version) == 2:
+            direction=dict_search('parameters.erspan.direction',self.config)
+            if direction:
+                command += f' erspan_dir {direction}'
+            hwid=dict_search('parameters.erspan.hwid',self.config)
+            if hwid:
+                command += f' erspan_hwid {hwid}'
+        
+        ttl = dict_search('parameters.ip.ttl',self.config)
+        if ttl:
+            command += f' ttl {ttl}'
+        tos = dict_search('parameters.ip.tos',self.config)
+        if tos:
+            command += f' tos {tos}'
+                
+        self._cmd(command)
+    
+    def change_options(self):
+        ifname = self.config['ifname']
+        local_ip = self.config['local_ip']
+        remote_ip = self.config['remote_ip']
+        key = self.config['parameters']['ip']['key']
+        version = self.config['parameters']['version']
+        command = f'ip link set dev {ifname} type erspan local {local_ip} remote {remote_ip} seq key {key} erspan_ver {version}'
+        
+        if int(version) == 1:
+            idx=dict_search('parameters.erspan.idx',self.config)
+            if idx:
+                command += f' erspan {idx}'
+        elif int(version) == 2:
+            direction=dict_search('parameters.erspan.direction',self.config)
+            if direction:
+                command += f' erspan_dir {direction}'
+            hwid=dict_search('parameters.erspan.hwid',self.config)
+            if hwid:
+                command += f' erspan_hwid {hwid}'
+        
+        ttl = dict_search('parameters.ip.ttl',self.config)
+        if ttl:
+            command += f' ttl {ttl}'
+        tos = dict_search('parameters.ip.tos',self.config)
+        if tos:
+            command += f' tos {tos}'
+                
+        self._cmd(command)
+
+class ER6SpanIf(_ERSpan):
+    """
+    ER6SpanIf: private base class for ERSPAN Over GRE and IPv6 tunnels
+    """
+    
+    def _create(self):
+        ifname = self.config['ifname']
+        local_ip = self.config['local_ip']
+        remote_ip = self.config['remote_ip']
+        key = self.config['parameters']['ip']['key']
+        version = self.config['parameters']['version']
+        command = f'ip link add dev {ifname} type ip6erspan local {local_ip} remote {remote_ip} seq key {key} erspan_ver {version}'
+        
+        if int(version) == 1:
+            idx=dict_search('parameters.erspan.idx',self.config)
+            if idx:
+                command += f' erspan {idx}'
+        elif int(version) == 2:
+            direction=dict_search('parameters.erspan.direction',self.config)
+            if direction:
+                command += f' erspan_dir {direction}'
+            hwid=dict_search('parameters.erspan.hwid',self.config)
+            if hwid:
+                command += f' erspan_hwid {hwid}'
+        
+        ttl = dict_search('parameters.ip.ttl',self.config)
+        if ttl:
+            command += f' ttl {ttl}'
+        tos = dict_search('parameters.ip.tos',self.config)
+        if tos:
+            command += f' tos {tos}'
+                
+        self._cmd(command)
+    
+    def change_options(self):
+        ifname = self.config['ifname']
+        local_ip = self.config['local_ip']
+        remote_ip = self.config['remote_ip']
+        key = self.config['parameters']['ip']['key']
+        version = self.config['parameters']['version']
+        command = f'ip link set dev {ifname} type ip6erspan local {local_ip} remote {remote_ip} seq key {key} erspan_ver {version}'
+        
+        if int(version) == 1:
+            idx=dict_search('parameters.erspan.idx',self.config)
+            if idx:
+                command += f' erspan {idx}'
+        elif int(version) == 2:
+            direction=dict_search('parameters.erspan.direction',self.config)
+            if direction:
+                command += f' erspan_dir {direction}'
+            hwid=dict_search('parameters.erspan.hwid',self.config)
+            if hwid:
+                command += f' erspan_hwid {hwid}'
+                
+        self._cmd(command)
diff --git a/smoketest/scripts/cli/test_interfaces_erspan.py b/smoketest/scripts/cli/test_interfaces_erspan.py
new file mode 100755
index 000000000..c180f0a34
--- /dev/null
+++ b/smoketest/scripts/cli/test_interfaces_erspan.py
@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import unittest
+import json
+
+from vyos.configsession import ConfigSession
+from vyos.configsession import ConfigSessionError
+from vyos.util import cmd
+
+from base_interfaces_test import BasicInterfaceTest
+
+mtu = 1500
+
+def erspan_conf(interface):
+    tmp = cmd(f'ip -d -j link show {interface}')
+    '''
+    [
+        {
+            "ifindex": 17,
+            "link": null,
+            "ifname": "ersp0",
+            "flags": [
+                "BROADCAST",
+                "MULTICAST"
+            ],
+            "mtu": 1450,
+            "qdisc": "noop",
+            "operstate": "DOWN",
+            "linkmode": "DEFAULT",
+            "group": "default",
+            "txqlen": 1000,
+            "link_type": "ether",
+            "address": "22:27:14:7b:0d:79",
+            "broadcast": "ff:ff:ff:ff:ff:ff",
+            "promiscuity": 0,
+            "min_mtu": 68,
+            "max_mtu": 0,
+            "linkinfo": {
+                "info_kind": "erspan",
+                "info_data": {
+                    "remote": "10.2.2.2",
+                    "local": "10.1.1.1",
+                    "ttl": 0,
+                    "pmtudisc": true,
+                    "ikey": "0.0.0.123",
+                    "okey": "0.0.0.123",
+                    "iseq": true,
+                    "oseq": true,
+                    "erspan_index": 0,
+                    "erspan_ver": 1
+                }
+            },
+            "inet6_addr_gen_mode": "eui64",
+            "num_tx_queues": 1,
+            "num_rx_queues": 1,
+            "gso_max_size": 65536,
+            "gso_max_segs": 65535
+        }
+    ]
+    '''
+    return json.loads(tmp)[0]
+
+class ERSPanTunnelInterfaceTest(BasicInterfaceTest.BaseTest):
+    def setUp(self):
+        super().setUp()
+
+        self._base_path = ['interfaces', 'erspan']
+        self._test_mtu = True
+
+        self.local_v4 = '10.1.1.1'
+        self.local_v6 = '2001:db8::1'
+        self.remote_v4 = '10.2.2.2'
+        self.remote_v6 = '2001:db9::1'
+
+    def tearDown(self):
+        self.session.delete(['interfaces', 'erspan'])
+        super().tearDown()
+
+    def test_erspan_ipv4(self):
+        interface = 'ersp100'
+        encapsulation = 'erspan'
+        key = 123
+
+        self.session.set(self._base_path + [interface, 'encapsulation', encapsulation])
+        self.session.set(self._base_path + [interface, 'local-ip', self.local_v4])
+        self.session.set(self._base_path + [interface, 'remote-ip', self.remote_v4])
+        self.session.set(self._base_path + [interface, 'parameters', 'ip' , 'key', str(key)])
+
+        self.session.commit()
+
+        conf = erspan_conf(interface)
+        self.assertEqual(interface, conf['ifname'])
+        self.assertEqual(encapsulation, conf['linkinfo']['info_kind'])
+        self.assertEqual(mtu, conf['mtu'])
+
+        self.assertEqual(self.local_v4, conf['linkinfo']['info_data']['local'])
+        self.assertEqual(self.remote_v4,     conf['linkinfo']['info_data']['remote'])
+
+
+    def test_erspan_ipv6(self):
+        interface = 'ersp1000'
+        encapsulation = 'ip6erspan'
+        key = 123
+
+        self.session.set(self._base_path + [interface, 'encapsulation', encapsulation])
+        self.session.set(self._base_path + [interface, 'local-ip', self.local_v6])
+        self.session.set(self._base_path + [interface, 'remote-ip', self.remote_v6])
+        self.session.set(self._base_path + [interface, 'parameters', 'ip' , 'key', str(key)])
+
+        self.session.commit()
+
+        conf = erspan_conf(interface)
+        self.assertEqual(interface, conf['ifname'])
+        self.assertEqual(encapsulation, conf['linkinfo']['info_kind'])
+        self.assertEqual(mtu, conf['mtu'])
+
+        self.assertEqual(self.local_v6, conf['linkinfo']['info_data']['local'])
+        self.assertEqual(self.remote_v6,     conf['linkinfo']['info_data']['remote'])
+
+if __name__ == '__main__':
+    unittest.main(verbosity=2)
diff --git a/src/conf_mode/interfaces-erspan.py b/src/conf_mode/interfaces-erspan.py
new file mode 100755
index 000000000..2d65b834c
--- /dev/null
+++ b/src/conf_mode/interfaces-erspan.py
@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2020 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from copy import deepcopy
+from netifaces import interfaces
+
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configdict import get_interface_dict
+from vyos.configdict import node_changed
+from vyos.configdict import leaf_node_changed
+from vyos.configverify import verify_mtu_ipv6
+from vyos.configverify import verify_tunnel
+from vyos.ifconfig import Interface
+from vyos.ifconfig import ERSpanIf
+from vyos.ifconfig import ER6SpanIf
+from vyos.template import is_ipv4
+from vyos.template import is_ipv6
+from vyos.util import dict_search
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least
+    the interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'erspan']
+    erspan = get_interface_dict(conf, base)
+    
+    tmp = leaf_node_changed(conf, ['encapsulation'])
+    if tmp:
+        erspan.update({'encapsulation_changed': {}})
+
+    return erspan
+
+def verify(erspan):
+    if 'deleted' in erspan:
+        return None
+    
+    if 'encapsulation' not in erspan:
+        raise ConfigError('Unable to detect the following ERSPAN tunnel encapsulation'\
+                          '{ifname}!'.format(**erspan))
+
+    verify_mtu_ipv6(erspan)
+    verify_tunnel(erspan)
+    
+    key = dict_search('parameters.ip.key',erspan)
+    if key == None:
+        raise ConfigError('parameters.ip.key is mandatory for ERSPAN tunnel')
+            
+
+def generate(erspan):
+    return None
+
+def apply(erspan):
+    if 'deleted' in erspan or 'encapsulation_changed' in erspan: 
+        if erspan['ifname'] in interfaces(): 
+            tmp = Interface(erspan['ifname']) 
+            tmp.remove() 
+        if 'deleted' in erspan: 
+            return None 
+    
+    dispatch = {
+        'erspan': ERSpanIf,
+        'ip6erspan': ER6SpanIf
+    }
+
+    # We need to re-map the tunnel encapsulation proto to a valid interface class
+    encap = erspan['encapsulation']
+    klass = dispatch[encap]
+    
+    conf = deepcopy(erspan)
+    
+    conf.update(klass.get_config())
+    
+    del conf['ifname']
+    
+    erspan_tunnel = klass(erspan['ifname'],**conf)
+    erspan_tunnel.change_options()
+    erspan_tunnel.update(erspan)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        generate(c)
+        verify(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces-tunnel.py b/src/conf_mode/interfaces-tunnel.py
index f03bc9d5d..034bd6dd1 100755
--- a/src/conf_mode/interfaces-tunnel.py
+++ b/src/conf_mode/interfaces-tunnel.py
@@ -29,6 +29,7 @@ from vyos.configverify import verify_bridge_delete
 from vyos.configverify import verify_interface_exists
 from vyos.configverify import verify_mtu_ipv6
 from vyos.configverify import verify_vrf
+from vyos.configverify import verify_tunnel
 from vyos.ifconfig import Interface
 from vyos.ifconfig import GREIf
 from vyos.ifconfig import GRETapIf
@@ -84,38 +85,7 @@ def verify(tunnel):
     verify_mtu_ipv6(tunnel)
     verify_address(tunnel)
     verify_vrf(tunnel)
-
-    if 'local_ip' not in tunnel and 'dhcp_interface' not in tunnel:
-        raise ConfigError('local-ip is mandatory for tunnel')
-
-    if 'remote_ip' not in tunnel and tunnel['encapsulation'] != 'gre':
-        raise ConfigError('remote-ip is mandatory for tunnel')
-
-    if {'local_ip', 'dhcp_interface'} <= set(tunnel):
-        raise ConfigError('Can not use both local-ip and dhcp-interface')
-
-    if tunnel['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
-        error_ipv6 = 'Encapsulation mode requires IPv6'
-        if 'local_ip' in tunnel and not is_ipv6(tunnel['local_ip']):
-            raise ConfigError(f'{error_ipv6} local-ip')
-
-        if 'remote_ip' in tunnel and not is_ipv6(tunnel['remote_ip']):
-            raise ConfigError(f'{error_ipv6} remote-ip')
-    else:
-        error_ipv4 = 'Encapsulation mode requires IPv4'
-        if 'local_ip' in tunnel and not is_ipv4(tunnel['local_ip']):
-            raise ConfigError(f'{error_ipv4} local-ip')
-
-        if 'remote_ip' in tunnel and not is_ipv4(tunnel['remote_ip']):
-            raise ConfigError(f'{error_ipv4} remote-ip')
-
-    if tunnel['encapsulation'] in ['sit', 'gre-bridge']:
-        if 'source_interface' in tunnel:
-            raise ConfigError('Option source-interface can not be used with ' \
-                              'encapsulation "sit" or "gre-bridge"')
-    elif tunnel['encapsulation'] == 'gre':
-        if 'local_ip' in tunnel and is_ipv6(tunnel['local_ip']):
-            raise ConfigError('Can not use local IPv6 address is for mGRE tunnels')
+    verify_tunnel(tunnel)
 
     if 'source_interface' in tunnel:
         verify_interface_exists(tunnel['source_interface'])