J,

I have configured the NAM and I have a netlow session coming from the access switches to the NAM. What type of session do I setup on the Distribution switches? I don't have any VLANs on those switches so I am thinking I can't do Netflow from the Distribution. How do I get the data from the Distribution switches to the NAM?

What type of switches are the distribution switches? What version of code are they running?

The switches are 6509s and they are running Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(33)SXH2a

You can do Netflow and MLS on these switches if you want (see http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/netflow.html ).

You can also do an remote SPAN session to the core switch which contains the NAM. This will allow you to mirror traffic from the distribution through a special RSPAN VLAN to your core switch with the NAM. See http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html for more details.

J,

I am configuring RSPAN and it is going okay but I am getting little confused though. The RSPAN config doc said that you configure a source session and destination session on different switches. This is what I have on the distribution switch, vlan 758 is on the core switch where the NAM module resides:

Session 75

----------

Type : Remote Source Session

Source Ports :

Both : Te1/1-4,Te2/1-4,Te3/1-3,Te4/1-2

Dest RSPAN VLAN : 758

Egress SPAN Replication State:

Operational mode : Centralized

Configured mode : Centralized (default

Config On the Core Switch, vlan 757 is the RSPAN Vlan on the distribution switch:

Session 75

----------

Type : Remote Destination Session

Source RSPAN VLAN : 757

I think I am missing something in my config can you see anything in my config?

Mario

The VLAN numbers don't agree. You need to trunk the RSPAN VLAN from the distribution switch to the core switch. See this diagram as a guide: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html#wp1037601 .

Okay, so the RSPAN vlans should be the same on both the Distribution and Core switch, i.e. vlan 757 should exist on both switches.

Yes, and it needs to be trunked between the two switches.

J,

Getting a trunk between my distribution and core switch turned into an issue my core switch has a 48-port ethernet blade in it but my distribution switch does not and I didn't want to use the ports on the supervisors either. So I just took an extra NAM I had and put in in the distribution switch so now I see all of the uplink interfaces in the switch. I plan to use RSPAN to get the information from the neighboring distribution switch. For the most part I am getting traffic to the NAM. Thanks for your help.