Monitor session - RSPAN - no output

[alanchia2000]

I am having difficulties with getting RSPAN traffic over my trunk link.

Here's the setup .

PC1 ---Gi1/0/1--- Core Sw -Gi1/0/2---Gi1/0/1--- Access switch ---Gi1/0/2--- PC2

PC3 ---Gi1/0/3--------|

PC 3 is sniffer.

PC1: 192.168.1.1/24

Core switch: 192.168.1.2/24 (Gi1/0/1)

Core Switch: 192.168.2.2/24 (Gi1/0/2)

Access switch: 192.168.2.1/24 (Gi1/0/1)

Access switch: 192.168.3.1/24 (Gi1/0/2)

PC2: 192.168.3.2/24

Cisco IOS 3750

Core sw

Interface Gi1/0/1

no switchport

ip address 192.168.1.2 255.255.255.0

no shut

Interface Gi1/0/2

no switchport

ip address 192.168.2.2 255.255.255.0

no shut

monitor session 1 source remote vlan 999

monitor session 1 destination interface Gi1/0/3

monitor session 2 source interface Gi1/0/1 rx

monitor session 2 destination remote vlan 999

Cisco IOS 3750

Access switch

Interface Gi1/0/1

no switchport

ip address 192.168.2.1 255.255.255.0

no shut

Interface Gi1/0/2

no switchport

ip address 192.168.3.1 255.255.255.0

no shut

monitor session 1 source interface gi1/0/2 rx

monitor session 1 destination remote vlan 999

I'm trying to ping from PC 2 to PC 1. Aparently, it wasn't captured on PC3 for some reason.

Could anyone help look at whether my "monitor session" statements are correctly configured.

Thanks.

[xcz504d1114]

Ah, ok I see what you are trying to do, I thought you were just monitoring just the one port.

In that case,

monitor session 1 source interface gi 1/0/1

monitor session 1 source remote vlan 999

monitor session 1 destination interface gi 1/0/3

Craig

[alanchia2000]

Hi Craig,

I think I have tried the commands you suggested, but the system allowed only either the source interface or source remote span session. What IOS version are you using on your 3750. I don't think I'm using the latest version.

Alan

[ciscohappy]

Does anyone know if the following 3 commands on all Cisco 3750s ? I don't think it works on mine?

monitor session 1 source interface gi 1/0/1

monitor session 1 source remote vlan 999

monitor session 1 destination interface gi 1/0/3

[xcz504d1114]

That was my bad, you can't combine both RSPAN and an interface in the same monitor session, it is either a RSPAN or not and RSPAN, not both.

Unfortunately I can't think of any other way to get the traffic you are wanting... I'm sure there is something I'm missing from the puzzle, maybe I will hit a eureka moment in the middle of the night :)

Maybe try:

monitor session 1 source int gi 1/0/1

monitor session 1 destination remote vlan 998

monitor session 2 source remote vlan 999

monitor session 2 source remote vlan 998

monitor session 2 destination int gi 1/0/3

You can have as many sources as you want, just a maximum number of 2 sessions, can't mix interfaces with VLAN's, so that meets all of the requirements...

HTH,

Craig

[alanchia2000]

Hi Craig,

Appreciate your help in this matter.

I've tried

monitor session 2 source remote vlan 999

monitor session 2 source remote vlan 998

monitor session 2 destination int gi 1/0/3

But it seems that only 1 source remote vlan was allowed on my Cisco 3750 though. Won't work in my scenario. Does it work over your end?

[xcz504d1114]

I've been out of my office for a few days, and my terminal server has been hung up, I'll have someone reset it and see what I can come up with.

Craig

[alanchia2000]

Hi, anyone able to help ?

Thanks in advance.

[ciscohappy]

Hello, appreciate any help :)