Can anyone point me in the right direction? I am trying to set up a data source on my access layer switch but I am not receiving anything on my NAM module in the core swtich. Can anyone shed a little light on what I may be missing. Thanks.
How have you configured the SPAN session? How have you configured the NAM? I assume you're using an RSPAN? It would be helpful to get a better understanding of the topology, as well as the version of code running on the NAM.
I have configured the NAM and I have a netlow session coming from the access switches to the NAM. What type of session do I setup on the Distribution switches? I don't have any VLANs on those switches so I am thinking I can't do Netflow from the Distribution. How do I get the data from the Distribution switches to the NAM?
The switches are 6509s and they are running Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(33)SXH2a
You can do Netflow and MLS on these switches if you want (see http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/netflow.html ).
You can also do an remote SPAN session to the core switch which contains the NAM. This will allow you to mirror traffic from the distribution through a special RSPAN VLAN to your core switch with the NAM. See http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html for more details.
I am configuring RSPAN and it is going okay but I am getting little confused though. The RSPAN config doc said that you configure a source session and destination session on different switches. This is what I have on the distribution switch, vlan 758 is on the core switch where the NAM module resides:
Type : Remote Source Session
Source Ports :
Both : Te1/1-4,Te2/1-4,Te3/1-3,Te4/1-2
Dest RSPAN VLAN : 758
Egress SPAN Replication State:
Operational mode : Centralized
Configured mode : Centralized (default
Config On the Core Switch, vlan 757 is the RSPAN Vlan on the distribution switch:
Type : Remote Destination Session
Source RSPAN VLAN : 757
I think I am missing something in my config can you see anything in my config?
The VLAN numbers don't agree. You need to trunk the RSPAN VLAN from the distribution switch to the core switch. See this diagram as a guide: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/span.html#wp1037601 .
Getting a trunk between my distribution and core switch turned into an issue my core switch has a 48-port ethernet blade in it but my distribution switch does not and I didn't want to use the ports on the supervisors either. So I just took an extra NAM I had and put in in the distribution switch so now I see all of the uplink interfaces in the switch. I plan to use RSPAN to get the information from the neighboring distribution switch. For the most part I am getting traffic to the NAM. Thanks for your help.