RSPAN

[boonteongng]

In a 3550, when I configure rspan at sw2 to monitor an interface at sw1, the destination interface at sw2 should belong to what vlan ?

e.g

vlan 99

remote-span

Sw1

monitor session 1 source interface fas0/1

monitor destination 1 destination remote vlan 99 reflector-port fas0/24

note: fas0/1 at sw1 belong to vlan 2.

fas0/24 at sw1 is an unused port.

sw2

monitor session 1 source remote vlan 99

monitor session 1 destination interface fas0/1

what vlan should I assign fas0/1 at sw2 to ? vlan 99 ? vlan 2 ? or leave it to default vlan 1 as it doesn't matter ?

Sniffer will be connected to this port.

[ankurbhasin]

Hi Friend,

The destination port in SPAN and RSPAN does not participate in sending or receiving normal network traffic other then monitored trafffic bydefault and that is the reason you will see the interface status for destination port as line protocl down (monitored) so you can leave it as it is in default vlan 1.

NOW if you want that destination port to participate as normal network port in addition to monitoring traffic you can use command "ingress" with vlan number for which you want that port to participate in sending and receiving traffic.

If you give this command

Switch(config)# monitor session 1 destination interface fastEthernet0/5 ingress vlan 5

destination port will work for monitoring purpose also and it will also sned and receive traffic for vlan 5

but like your config goes

monitor session 1 destination interface fas0/1

It will only work as monitoring port.

You can read this doc for more details

http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12120ea2/3550scg/swspan.htm#wp1336427

HTH

Ankur