RSPAN Recommendations

[rmujeeb81]

Hi,

I have following topology,

SW1---SW2----SW3

I want to monitor 2 ports on SW1 and traffic analyzer is connected with SW3. I have configured RSPAN VLAN and defined source ports for monitor session on SW1, destination would be RSPAN VLAN. I am having confusion in configuring RSPAN parameters on SW2. On Sw2 I will have to configure 'monitor session 1 source vlan 500(RSPAN VLAN )' but what about destination ?

Can I configure RSPAN vlan both as source and destination ? or I need to configure trunk port b/w SW2 & SW3 as destination on SW2 ?

HTH,

[Giuseppe Larosa]

Hello Mujeeb,

all switches need to have the RSPAN vlan defined as rspan

config t

vlan 900

remote-span

this tell the switches to disable MAC address learning.

A l2 path made of trunk ports have to exist between SW1,Sw2 and SW2,SW3.

Sw2 doesn't need anything else it just carries frames with vlan tag from a trunk to the other.

Sw1 has monitor session configured for the two ports and destination= remote span vlan.

Sw3 on the opposite has

destination= port where the sniffer is connected

source = remote span vlan

Use a new dedicated vlan as remote span to avoid traffic to be replicated on unnecessary ports.

Hope to help

Giuseppe

[rmujeeb81]

Hi,

It means we don't need to configure anything extra on SW2 except a working trunk ?

HTH,

[Giuseppe Larosa · Accepted solution]

Hello Mujeeb,

the vlan has to be defined as remote span vlan this is needed also on SW2.

Besides this SW2 needs only two trunk links where the remote span vlan is permitted

no monitor commands are needed on SW2

Hope to help

Giuseppe