RSPAN with intermidiate switch. Where ports on intermidiate switch also acts as a RSPAN source

[MaximBudyonny]

Hello,

I'm confused with rspan.
The task.

Send mirrored traffic from sw2 to the sensor connected to sw3 through sw1. The issue is that sw1 have been already configured to act as source for rspan.

Here is the scheme:

endpoints to be monitored 2
|

trunk

|
[[[sw2 cat3750]]]
|

trunk
|
[[[sw1 cat4507]]]---endpoints that are already monitored
|

trunk
|
[[[sw3 cat4503]]]--sensor

Just now, traffic from sources connected to sw1 is sending via rspan to sensor sw1-->sw3. It works pretty fine.

Can I just add rspan as a remote source on sw2?

==on sw2==
vlan 1000
remote-span

monitor session 1 source interface <list>
monitor session 1 destination remote vlan 1000

==on sw1==
--------here is already working rspan config
monitor session 2 source interface  <list>
monitor session 2 destination remote vlan 1000

==on sw3==
--------here is already working rspan config
monitor session 2 destination interface Gi2/18
monitor session 2 source remote vlan 1000

[Giuseppe Larosa]

Hello Maxim,

you would need a second RSPAN session to be on the safe side as RSPAN vlan disables mac address learning

Hope to help

Giuseppe

[MaximBudyonny]

Thank you for reply.

As I understand you have proposed to create new rspan session with a new vlan on sw2 and simply carry this new vlan through sw1 to sw3.

I also thought to do it in the same way.

But on sw3 (cat4503) it's not possible to create monitor sessions with 2 or more rspan sources.

New monitor on the sw3 session for a new rspan vlan  is not a solution, because destination interface have been already configured in another session.

May be I'm not clearly understand your answer?

I'm thinking about direct connection of the sw2 to the sw3 and distributing vlan 1000 (existed rspan vlan) accros the triangle but I'm afraid of network loops.

[MaximBudyonny]

Hello!

I've just added additional  session on sw2 and all works fine.

May be this trick is no correct but it works