SPAN and RSPAN with VLAN question

[ddcarlson]

I can't seem to figure this out. I'm hoping someone can help me out. We have two 3560 series switches (we'll call them A & B). VLAN 5 traffic is spread accross both switches. I want to monitor all VLAN 5 traffic to port 24 of switch A. If I do this I can only see traffic happening on the local switch (A):

monitor session 1 source vlan 5

monitor session 1 destination interface Fa0/24

I tried to setup RSPAN, but it seems like it will only monitor traffic from the remote switch of VLAN 5. It doesn't seem to let me mix both. How can I do this?

Thanks, -D

[fzamora]

Unfortunately is not possible. You will required a third switch in order to use it as a RSPAN destination from the other two.

Franco Zamora

[fzamora]

More information:

The switch does not support a combination of local SPAN and RSPAN in a single session. That is, an RSPAN source session cannot have a local destination port, an RSPAN destination session cannot have a local source port, and an RSPAN destination session and an RSPAN source session that are using the same RSPAN VLAN cannot run on the same switch.

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/12235se/scg1/swspan.htm#wp1251490

[ddcarlson]

It looks like I got it working with TACS help:

On the switch that has destination port, please try the following configuration.

monitor session 1 source vlan

monitor session 1 source vlan 5

monitor session 1 destination interface

On the Remote switch,

monitor session 1 source vlan 5

monitor session 1 destination remote vlan