RSPAN problem

alanchia2000 · ‎07-30-2009

I have two switches. One core switch and another access switch which both I am trying to monitor the traffic using the following statements.

Core sw __Gi1/0/5_ Access switch

|_________Gi1/0/3_ Monitoring console

|_________Gi1/0/1_ PC

! On the core switch

monitor session 1 source remote vlan 999

monitor session 1 destination interface Gi1/0/3

monitor session 2 source interface Gi1/0/1 rx

monitor session 2 destination remote vlan 999

I can monitor the access switch, the problem is that Gi1/0/1 which is local to the core switch gives me nothing when I monitor it.

! This 2 statements doesn't seem to work for me.

monitor session 2 source interface Gi1/0/1 rx

monitor session 2 destination remote vlan 999

Any help would be appreciated.

Giuseppe Larosa · ‎07-31-2009

Hello Mun,

it is unclear what you are trying to do.

vlan 999 is a remote span vlan and allows you to capture traffic on access layer switch to carry it inside vlan 999 over a trunk port to core switch and to deliver it on port g1/0/3.

then you have a second session with source g1/0/1.

if you want to have on g1/0/3 traffic from both vlan999 and port g1/0/1 you should try:

use a single monitor session with two sources and one destination

In other words if you put traffic on vlan999 you are sending it to access layer switch not to port g1/0/3.

I understand you think access switch could reflect it to core switch but this is not happening I guess.

Hope to help

Giuseppe

alanchia2000 · ‎07-31-2009

Hi Giuseppe,

Thanks for explaining the concept for the 2nd session.

What you mentioned is what my intentions are. The problem is I am using Cisco 3750 and "use a single monitor session with two sources and one destination" is not allowing me to do that. I can have only 1 of the source running on switch.

Regards,

Alan