RSPAN with intermidiate switch. Where ports on intermidiate switch also acts as a RSPAN source

Unanswered Question
Sep 2nd, 2010
User Badges:

Hello,


I'm confused with rspan.
The task.


Send mirrored traffic from sw2 to the sensor connected to sw3 through sw1. The issue is that sw1 have been already configured to act as source for rspan.


Here is the scheme:


endpoints to be monitored 2
|

trunk

|
]
|

trunk
|
]---endpoints that are already monitored
|

trunk
|
]--sensor


Just now, traffic from sources connected to sw1 is sending via rspan to sensor sw1-->sw3. It works pretty fine.


Can I just add rspan as a remote source on sw2?



==on sw2==
vlan 1000
remote-span


monitor session 1 source interface <list>
monitor session 1 destination remote vlan 1000


==on sw1==
--------here is already working rspan config
monitor session 2 source interface  <list>
monitor session 2 destination remote vlan 1000


==on sw3==
--------here is already working rspan config
monitor session 2 destination interface Gi2/18
monitor session 2 source remote vlan 1000

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Giuseppe Larosa Thu, 09/02/2010 - 08:11
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Maxim,

you would need a second RSPAN session to be on the safe side as RSPAN vlan disables mac address learning


Hope to help

Giuseppe

MaximBudyonny Thu, 09/02/2010 - 08:45
User Badges:

Thank you for reply.



As I understand you have proposed to create new rspan session with a new vlan on sw2 and simply carry this new vlan through sw1 to sw3.



I also thought to do it in the same way.


But on sw3 (cat4503) it's not possible to create monitor sessions with 2 or more rspan sources.


New monitor on the sw3 session for a new rspan vlan  is not a solution, because destination interface have been already configured in another session.



May be I'm not clearly understand your answer?



I'm thinking about direct connection of the sw2 to the sw3 and distributing vlan 1000 (existed rspan vlan) accros the triangle but I'm afraid of network loops.

MaximBudyonny Fri, 09/03/2010 - 01:32
User Badges:

Hello!


I've just added additional  session on sw2 and all works fine.


May be this trick is no correct but it works

Actions

This Discussion