Trying to understand all my options for getting data from remote sites to EH. Assuming we have many small sites all interconnected via high speed WAN and only a single EH v6 at HQ. As I understand it, we have the following options to capture traffic at the remote sites and deliver to EH at HQ.
Span (local only)
Tap (local only)
RSPAN (local L2 only)
ERSPAN (Remote via GRE, but Cisco proprietary - sites are mostly Juniper)
RPCAP (Local or Remote but seems intrusive and difficult to implement/manage)
And of course the favorite method for EH sales reps, buy an EH for every site!
Am I missing anything? Curious how others have solved this dilemma?