questions about RSPAN

[egr1985]

My main question is it possible to create an RSPan where source ports are location on sw1 and sw2 with the destination port to a remote collector also resides on sw 2. And two what would the commands be?

what i was thinking was this:

SW1 :

vlan 999 remote-span

monitor session 1 source giga 1/0/1-23

monitor session 1 destination remote vlan 999

sw2:

vlan 999 remote-span

monitor session 1 source giga 1/0/1-23(port 23 would be the trunk between the two switches)

monitor session 1 destination int giga 1/0/24 to remote collector

[Cristian Matei]

Hi,

   Your config on SW1 looks correct, however, on SW2 it should be:

vlan 999
 remote-span
monitor session 1 source remote vlan 999
monitor session 1 destination interface giga 1/0/24

You need one trunk interface between the two switches that allows VLAN 999; additionally, based on traffic volume of VLAN999, would be recommended to have an additional dedicated trunk between the two switches where only VLAN 999 is allowed.

Thanks,

Cristian.

[M02@rt37]

Hello @egr1985 

On SW2, the trafic coming from Sw1 arrives inside the RSPAN VLAN (999), so SW2 must explicitly declare that vlan as a remote source !

You don't re-SPAN the access ports on SW2 unless you want local traffic from SW2 as well (that would require a second session)...

[egr1985]

yes, thats what i am trying to accomplish. collecting all traffic from all ports on sw1 and sw2 to a remote collector for an IDS

[M02@rt37 · Accepted solution]

Hello @egr1985 

OK, dont include on Sw1 the Trunk port to your monitor session:

monitor session 1 source interface Gi1/0/1-22
monitor session 1 destination remote vlan 999

On SW2 _ 2 sessions:

monitor session 1 source remote vlan 999
monitor session 1 destination interface Gi1/0/24

monitor session 2 source interface Gi1/0/1-22
monitor session 2 destination interface Gi1/0/24 

Gi1/0/24 where your IDS is plunged.

---

On both Sw:

vlan 999
remote-span

[egr1985]

hello,

when i attempted to put the monitor session 2 on the second switch with the same destination port 1/0/24 it returned "Interface(s) gi1/0/24 already configured as monitor destinations in other monitor sessions

[Cristian Matei]

Hi,

   Use a single RSPAN session, and configure both remote VLAN 999 and additional local interface as source, while keeping interface Gi1/0/24 as destination.

Thanks,

Cristian.