Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

Configuring RSPAN

I have two 6509 switches trunked together.

6509 #1 is downstairs, 6509 #2 is up stairs.

There is also a router connected to the 6509 upstairs that connects our remote sites to the main site.

I have a 3550 switch downstairs that is used in a training room, also trunked to the 6509 upstairs.

We have a network monitoring device that is going to sit upstairs on the 6509 #2.

We would like to set up a session that will capture all traffic on the internal network.

If I create an RSPAN session on the switches to capture all vlans that I want to monitor and the destination port is on the upstairs 6509, will I also be able to capture the traffic on the upstairs 6509?

The source vlans are on all switches and I am unclear when configuring the RSPAN session, if the destination port on the upstairs 6509 will also capture traffic on the VLAN ports on the same switch.

For example, if I configure the RSPAN to capture (source VLANs) VLAN 2-20 and the destination port is on the upstairs 6509, will I also capture the traffic on the ports that are members of VLANs 2-20 on the upstairs 6509 where the destination port resides?

Question 2:

Will I also capture the traffic inbound from the router in those VLANS on the upstars switch?

5 REPLIES
New Member

Re: Configuring RSPAN

Hi,

As per the rspan functoinality,all configured source vlans/ports traffic will be carried in rspan vlan which is specifically confugured to forward rspan traffic to destination port/monitoring port.

check this:http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a0080121d34.html

so answer is yes it will carry if configured on upstair switch.

hope this will help.

rgrds,

New Member

Re: Configuring RSPAN

Ok then if I can do it then, I will configure this on the remote switches:

Conf t

vlan 998

remote-span

monitor session 1 source VLAN 2-20

monitor session 1 destination remote vlan 998

But how do I configure the destination switch to to monitor the source VLANs locally and remotely?

For example, my understanding is that the source switches are going to send all VLANs configured to VLAN998

on the destination switch:

conf t

monitor session 1 source vlan xxx

monitor session 1 destination interface fa X/x -> port connected to the monitoring server.

How do I set the upstairs switch to be the destination switch for remote RSPN vlan 998 and to source all the other local VLANs on it?

New Member

Re: Configuring RSPAN

Configure the RSpan vlan in destination switch and also trunk the vlan 998 to other switch.

vlan 998

remote-span

monitor session 1 source remote vlan 998

monitor session 1 destination int X/X

New Member

Re: Configuring RSPAN

Here the RSPAN configuration for 6509#2 connected to the network monitoring device.

!Define the RSPAN VLAN Let's say vlan 100

vlan 100

remote-span

! Monitor session 1 captures bidirectional traffic from source vlan's to RSPAN VLAN 100.

monitor session 1 source vlan 2 - 20

monitor session 1 destination remote vlan 100

! Monitor session 2 captures bidirectional traffic from RSPAN VLAN 100 to interface conected to network monitoring device

!for ex fa4/29 connected to network monitoring device

monitor session 2 source remote vlan 100

monitor session 2 destination interface fa4/29

On downstair switches do the following configuration

!Define the RSPAN VLAN Let's say vlan 100

vlan 100

remote-span

! Monitor session 1 captures bidirectional traffic from source vlans to RSPAN VLAN 100

monitor session 1 source vlan 2 - 20

monitor session 1 destination remote vlan 100

hope this will help

Regrds

Deepak Pandey

New Member

Re: Configuring RSPAN

Hi All,

Add-on ..lets say if I have one remote switch at floor 5 that I only want to monitor port fa0/14 and it is on vlan 3, how can I do it at the destination switch in floor 10.THe port i wanna sniff with ethereal is at port fa0/5 switch at floor 10.

What is the configuration for the source and destination switch?

thanks in advanced!

626
Views
10
Helpful
5
Replies
CreatePlease to create content