We have a number of sites where we are using RSPAN over LAN-extension services for mirroring Voice VLAN traffic to a centralised voice recorder.
Across the sites and the core network we have configured one RSPAN VLAN. On each edge switch we are capturing voice vlan traffic (rx and tx) and setting the monitor session destination as the RSPAN VLAN. In the core, we use the RSPAN VLAN as a monitor session source and map it onto a physical destination port (where the voice recorder resides).
So, at the edge sites we have:
monitor session 1 source vlan <VOICE VLAN>
monitor session 1 destination remote 900
At in the core, we have
monitor session 1 source remote vlan 900
monitor session 1 destination interface fastEthernet 8/19
(The edge switches are 3750s, and the core is a 6509 switch with Sup720 srunning IOS 12.2(18)SXD7b).
What we are seeing is heavy utilisation on the remote site LES links and it appears to be RSPAN VLAN traffic replicated across all trunks, not just the traffic sourced from the local site and significant inbound traffic on VLAN 900 at the edge switches, which I wouldn't expect to see (we've temporarily pruned the RSPAN VLAN from a edge site trunk and seen the inbound traffic levels fall). If an RSPAN VLAN is common across a number of edge switches (because they all require RSPAN), will traffic be replicated across all trunks?
We had considered using an RSPAN VLAN per remote site, but different RSPAN source VLANs cannot map to a single physical destination port in the core.