04-10-2007 09:52 AM - edited 03-05-2019 03:23 PM
I can't seem to figure this out. I'm hoping someone can help me out. We have two 3560 series switches (we'll call them A & B). VLAN 5 traffic is spread accross both switches. I want to monitor all VLAN 5 traffic to port 24 of switch A. If I do this I can only see traffic happening on the local switch (A):
monitor session 1 source vlan 5
monitor session 1 destination interface Fa0/24
I tried to setup RSPAN, but it seems like it will only monitor traffic from the remote switch of VLAN 5. It doesn't seem to let me mix both. How can I do this?
Thanks, -D
04-10-2007 10:03 AM
Unfortunately is not possible. You will required a third switch in order to use it as a RSPAN destination from the other two.
Franco Zamora
04-10-2007 11:19 AM
More information:
The switch does not support a combination of local SPAN and RSPAN in a single session. That is, an RSPAN source session cannot have a local destination port, an RSPAN destination session cannot have a local source port, and an RSPAN destination session and an RSPAN source session that are using the same RSPAN VLAN cannot run on the same switch.
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/12235se/scg1/swspan.htm#wp1251490
04-10-2007 11:35 AM
It looks like I got it working with TACS help:
On the switch that has destination port, please try the following configuration.
monitor session 1 source vlan
monitor session 1 source vlan 5
monitor session 1 destination interface
On the Remote switch,
monitor session 1 source vlan 5
monitor session 1 destination remote vlan
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide