Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

How to configure SPAN from local and remote port

Hi all,

Now, I have two cisco Switches ( 3560) ( Sw1 and Sw2).They connect to each other via trunk port. I want to configure span from port g0/1 in Sw1 and port g0/1 in Sw2 to port g0/2 in Sw1.

Could you show me how to configure this ?

Thanks

Thuc

4 REPLIES
Cisco Employee

Re: How to configure SPAN from local and remote port

Hi Nguyen,


Just wanted to be clear.  You would like to monitor traffic sourced from g0/1 on switch 1 to g0/2 on switch 1 AND monitor traffic sourced from g0/1 on switch 2 to g0/2 on switch 1 as well.  So basically, you only have one sniffer that connects to g0/2 switch 1, and, switch 1 and switch 2 are interconnected with a trunk connection.  Is this correct?  Thanks.

Regards,

Jennifer

New Member

Re: How to configure SPAN from local and remote port

Hi Jenifer,

I want to monitor g0/1 in Sw1 and g0/1 in Sw2. My analyzer system is located in g0/2 Sw1. So, I configured:


SW2(config)#Vlan 11
SW2(config-vlan)#remote-span
SW2(config-vlan)#exit
SW2(config)#monitor session 1 source interface Gi0/1
SW2(config)#monitor session 1 destination remote vlan 11

SW1(config)#Vlan 11
SW1(config-vlan)#remote-span
SW1(config-vlan)#exit
SW1(config)#monitor session 1 source interface Gi0/1
SW1(config)#monitor session 1 destination interface g0/2
SW1(config)#monitor session 1 source vlan 11
% Cannot add VLANs as sources for SPAN session 1


I also tried this command:

SW1(config)#monitor session 1 source remote vlan 11
% Cannot add RSPAN VLAN as source for SPAN session 2 as it is not a RSPAN Destination session

Can you give me for any ideas for my issue?

Thuc

Cisco Employee

Re: How to configure SPAN from local and remote port

Hi Nguyen,

You are hitting the limitation here.  You cannot mix source ports and source vlans within a single SPAN session.  Here is a reference URL:

http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst3560/software/release/12.2_55_se/configuration/guide/swspan.html#wp1207676

-look under "SPAN Configuration Guidelines"

"•For SPAN sources, you can monitor traffic for a single port or VLAN or a series or range of ports or VLANs for each session. You cannot mix source ports and source VLANs within a single SPAN session."

Though you can set up two monitor session, one for local source port g0/1 and one for van 11, however, you will be hitting another limitation:

"•You cannot have two SPAN sessions using the same destination port."

If you can only have one sniffer on switch 1, the only thing I can think of is to set up a single connection between switch 1 and switch 2, for example, switch 1 g0/10 to switch 2 g0/10.  Then, you set up a local SPAN session on switch 2 as follow:

monitor session 1 source int g0/1
monitor session 1 destination int g0/10

And on switch 1, set up the following:

monitor session 1 source int g0/10
monitor session 1 source int g0/1
monitor session 1 destination int g0/2

Hope it helps.

Regards,

Jennifer

New Member

Re: How to configure SPAN from local and remote port

Hi Jenifer,

I see the limitation. But I need an workaround for this case. I will try yours.

Thanks,

Thuc

636
Views
5
Helpful
4
Replies