2950T RSPAN

[patrick.lopez]

Need some help please.

I have two 2950T-24’s. SW1 and SW2. They are connected via an ether-channel bundle with 802.1q trunking between the two.

I have a router plugged into each switch. R1 plugs into Fa0/3 of SW1 and R2 plugs in Fa0/3 of SW2. There is a sniffer in port Fa0/24 on SW1.

I would like to copy traffic from both routers interfaces. (SW1 fa0/3 and SW2 fa0/3) to the sniffer port SW1 Fa0/24. Is this possible with the RSPAN command? Code version is Version 12.1(22)EA3.

Thanks

Pat

[amit-singh]

Hi Patrick,

That is possible because on 2950 RSPAN destination and SPAN source sessions can co-exist at the same time.

Please check the following link:

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/12120ea2/2950scg/swspan.htm#wp1258110

HTH

-amit singh

[patrick.lopez]

Thank you,

Yes I have seen this link. When I try to execute the commands the switch does not allow me to put the destination port fa0/24 on SW1 twice.

Also at this point i belive i should be able to see traffic from fa0/3 SW2 on port fa0/24 on SW1. But unfortunately I do not.

These are the commands that i have.

SW1

monitor session 2 source remote vlan 500

monitor session 2 destination interface fastEthernet0/24

monitor session 1 source interface fa0/3

monitor session 1 destination interface fastEthernet0/24 (switch rejects this command)

SW2

monitor session 2 source interface Fa0/3

monitor session 2 destination remote vlan 500 reflector-port Fa0/10

Thank you.

[amit-singh]

Pat,

I think there is a limitaion on the destination port that it could not be the same port for both the RSPAN and SPAN session. Try giving a different destination port for a local Span session.If that also doesnot work out then its the hardware limitaion and I suppose we can run either only a SPAN session or RSPAN session.

HTH

-amit singh