CBS350 Multiple destination SPAN/RSPAN

[Dave K]

Hi,

Does the CBS350 support using the same data source(s) for multiple destination session definitions?

I currently have a RSPAN destination configured using a VLAN source, and would like to use the same VLAN source for an additional SPAN destination session.  Is this a supported configuration?

Thanks,

--Dave

[balaji.bandi]

Look at the limitation :

Please, do not add the destination port to the source/remote VLAN.

A port cannot be configured as reflector if it belongs to the remote VLAN.

The remote VLAN cannot be configured as a source VLAN.

https://www.cisco.com/c/en/us/td/docs/switches/lan/csbms/CBS_250_350/CLI/cbs-350-cli-/span-and-rspan-commands.html

[Dave K]

Balaji,

I am fully aware of that limitation.

I'll ask again - Can multiple SPAN/RSPAN destination sessions be configured to use the same sources?

Example: VLAN 10 is defined as a source for an RSPAN destination on GE1.  Can I create an additional SPAN/RSPAN destination on GE2 which is ALSO uses VLAN 10 as its source?  As acknowledged above, the SPAN/RSPAN destinations are not members of VLAN 10.

Thanks,

--Dave

[balaji.bandi]

If I understand correctly technically this is possible (and i know this was supported in Enterprise switches) - not sure SMB switch, this is required to test.

[Dave K]

Balaji,

I posted here because specifically because I didn't want to rely upon 'testing' to see if it appeared to work.

A primary motivation for posing the question was that that IOS documents this scenario as supported whereas the CBS350 documentation is silent.

Perhaps a 'Cisco Employee' will provide an informed response.

Thanks,

--Dave

[balaji.bandi]

CBS350 documentation is silent.  - agreed (but sometimes cisco documents also say it works never works code to code)

Glad you were able to find the solution.

[MaxShantar · Accepted solution]

Yes, the Cisco Business 350 Series Managed Switches support using the same data source(s) for multiple destination session definitions. This can be useful in scenarios where you want to send data from a single source to multiple destinations, such as when you want to monitor network traffic across multiple devices or locations.

To use the same data source(s) for multiple destination session definitions on a Cisco Business 350 Series Managed Switch, you can use the following steps:

1. Log in to the switch's web-based interface and go to the "Monitoring" section.

2. Click on the "Session Definitions" tab and then click the "Add" button to create a new session definition.

3. In the "Source" section, specify the data source(s) that you want to use. This can be an individual port, a range of ports, or a VLAN.

4. In the "Destination" section, specify the destination(s) where you want to send the data. This can be an individual port, a range of ports, or a VLAN.

5. Repeat these steps for each additional destination session definition that you want to create, using the same data source(s) each time.

6. Once you have configured all of your destination session definitions, click the "Apply" button to save your changes and enable the session definitions.

Note that the exact steps and options for configuring session definitions on a Cisco Business 350 Series Managed Switch may vary depending on the specific model and firmware version of the switch.

[Dave K]

Though we did ultimately deploy many CBS350 switches, we may be incurring RSPAN issues related to CSCva97586.

The bug states "RSPAN—If traffic is simultaneously forwarded to a destination port due to a mirror operation and another
operation (such as regular forwarding), not all traffic is mirrored to the RSPAN destination port."

It is unclear to me whether the context of "... and another operation..." is limited to the physical interface which is the RSPAN destination, or whether the context is any other packet forwarding operation within the switch itself even if not associated with an active (R)SPAN source or destination. 

If the meaning is any other operation on the physical port, then removing the port from all VLAN participation and just using the port as an RSPAN destination would be a workaround.  I've done that, yet there are indications that the RSPAN session is still dropping packets.

In this application, the RSPAN destination's source is VLAN '1', most of the access ports and traffic through the switch is simply untagged VLAN 1.  For management, the switches share a common trunk backbone with other switches and routers, so most of the traffic on those trunks is simply passing through.

Could someone from Cisco please elaborate on the scope of this bug, and whether or not the changes I made are a work around?

Thanks,

--Dave