How to configure SPAN from local and remote port

[Nguyen KeThuc]

Hi all,

Now, I have two cisco Switches ( 3560) ( Sw1 and Sw2).They connect to each other via trunk port. I want to configure span from port g0/1 in Sw1 and port g0/1 in Sw2 to port g0/2 in Sw1.

Could you show me how to configure this ?

Thanks

Thuc

[Jennifer Yeung]

Hi Nguyen,

Just wanted to be clear.  You would like to monitor traffic sourced from g0/1 on switch 1 to g0/2 on switch 1 AND monitor traffic sourced from g0/1 on switch 2 to g0/2 on switch 1 as well.  So basically, you only have one sniffer that connects to g0/2 switch 1, and, switch 1 and switch 2 are interconnected with a trunk connection.  Is this correct?  Thanks.

Regards,

Jennifer

[Nguyen KeThuc]

Hi Jenifer,

I want to monitor g0/1 in Sw1 and g0/1 in Sw2. My analyzer system is located in g0/2 Sw1. So, I configured:

SW2(config)#Vlan 11
SW2(config-vlan)#remote-span
SW2(config-vlan)#exit
SW2(config)#monitor session 1 source interface Gi0/1
SW2(config)#monitor session 1 destination remote vlan 11

SW1(config)#Vlan 11
SW1(config-vlan)#remote-span
SW1(config-vlan)#exit
SW1(config)#monitor session 1 source interface Gi0/1
SW1(config)#monitor session 1 destination interface g0/2
SW1(config)#monitor session 1 source vlan 11
% Cannot add VLANs as sources for SPAN session 1

I also tried this command:

SW1(config)#monitor session 1 source remote vlan 11
% Cannot add RSPAN VLAN as source for SPAN session 2 as it is not a RSPAN Destination session

Can you give me for any ideas for my issue?

Thuc

[Jennifer Yeung]

Hi Nguyen,

You are hitting the limitation here.  You cannot mix source ports and source vlans within a single SPAN session.  Here is a reference URL:

http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst3560/software/release/12.2_55_se/configuration/guide/swspan.html#wp1207676

-look under "SPAN Configuration Guidelines"

"•For SPAN sources, you can monitor traffic for a single port or VLAN or a series or range of ports or VLANs for each session. You cannot mix source ports and source VLANs within a single SPAN session."

Though you can set up two monitor session, one for local source port g0/1 and one for van 11, however, you will be hitting another limitation:

"•You cannot have two SPAN sessions using the same destination port."

If you can only have one sniffer on switch 1, the only thing I can think of is to set up a single connection between switch 1 and switch 2, for example, switch 1 g0/10 to switch 2 g0/10.  Then, you set up a local SPAN session on switch 2 as follow:

monitor session 1 source int g0/1
monitor session 1 destination int g0/10

And on switch 1, set up the following:

monitor session 1 source int g0/10
monitor session 1 source int g0/1
monitor session 1 destination int g0/2

Hope it helps.

Regards,

Jennifer

[Nguyen KeThuc]

Hi Jenifer,

I see the limitation. But I need an workaround for this case. I will try yours.

Thanks,

Thuc