Rspan not seing everything ...

[bayoucisco]

Hello,

I have 2 catalyst 6500 with a trunk in between :

interface GigabitEthernet1/1

no ip address

switchport

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 1-1005

switchport mode trunk

I have an rspan vlan :

vlan 500

name RSPAN

remote-span

On the first swith I send some vlan in the rspan vlan :

monitor session 1 source vlan 20 - 22 , 60 , 78

monitor session 1 destination remote vlan 500

and on the second switch I do the same and forward the rspan vlan to en interface :

monitor session 1 source vlan 20 - 22 , 60 , 78

monitor session 1 destination remote vlan 500

monitor session 2 destination interface Fa5/1

monitor session 2 source remote vlan 500

The interface configuration :

interface FastEthernet5/1

no ip address

We see some traffic from both switch but not everything ...

As it is a qualification platform we have only very few trafic so we are able to see that we are missing some ... (as the service is correctly working...)

Any clue why my rspan configuration is not correctly working ? :-)

Thanks !

[leighharrison]

Hi there,

It looks like the problem is on the second switch:-

"monitor session 1 destination remote vlan 500"

There is no need to punt this data to the remote vlan, as it is not inteded to leave the switch.

Change that line to:-

"mon sess 2 des int f5/1" and it should work ok.

Regards,

LH

Please rate all posts

[bayoucisco]

Hello,

Thanks for the answer, but when I try that, I get an error saying inf F5/1 is already used in an other monitoring session. And if I want to add local vlans and the remote vlan on the same session I also get an error :

monitor session 1 source vlan 20 - 22 , 60 , 78

monitor session 1 destination remote vlan 500

monitor session 2 destination interface Fa5/1

monitor session 2 source remote vlan 500

SWL2-2(config)#no monitor session 1 destination remote vlan 500

SWL2-2(config)#no monitor session 2 source remote vlan 500

SWL2-2(config)#monitor session 1 source remote vlan 500

% Cannot add RSPAN VLAN as source for SPAN session 1 as it is not a RSPAN Destin ation session

SWL2-2(config)#monitor session 2 source remote vlan 500

SWL2-2(config)#monitor session 2 destination interface Fa5/1

SWL2-2(config)#

SWL2-2(config)#monitor session 1 destination interface Fa5/1

% Interface(s) Fa5/1 already configured as monitor destinations in other monitor sessions

:-(

[leighharrison]

Hello again!

Have you tried making the a single session? There should be no issues with that. Try something like:-

mon sess 1 sou remote vlan 500

mon sess 1 sou vlan 20-22,60,78

mon sess 1 des int f5/1

Regards,

LH

Please rate all posts

[bayoucisco]

Yes if you read my last message I was not able to add a remote vlan and local vlan in source of the first mon sess :-(

[leighharrison]

Hi there,

I'm afraid that the only way may be to bring it in on two seperate interfaces and plug into a hub, then connect the protocol analyser in the hub so that you can grab the two sources.

Regards,

LH

Please rate all posts