2960-X. Problem with both local and remote SPAN

[hoffa2000]

Hi all

I'm trying to set up some SPAN and RSPAN on two directly connected 2960-Xs and get a problem half way through.

The relevant config is

Remote SPAN VLANs
------------------------------------------------------------------------------
999

Switch 1

monitor session 1 source interface Gi1/0/4
monitor session 1 destination remote vlan 999

Switch 2

monitor session 1 source interface Gi1/0/8 - 9
monitor session 1 source interface Gi2/0/8 - 9
monitor session 1 filter vlan 173
monitor session 1 destination remote vlan 999
monitor session 2 destination interface Gi2/0/21
monitor session 2 source remote vlan 999

I've got wireshark running on a PC connected to switch 2 port g2/0/21 and servers I need to monitor on switch 1 port g1/0/4, switch 2 g1/0/8-9 and switch 2 g2/0/8-9. Pretty simple setup I thought and if I run a wireshark on virtual PC that monitors VLAN 999 I see the traffic I need.

However not on the PC connected to port 2/0/21, that PC only sees the traffic coming in from switch 1, none of the traffic generated locally on switch 2. Making g2/0/21 on switch 2 destination port for both RSPAN and local SPAN doesn't work so how would I proceed? Is there something I've forgotten.

Regards

Fredrik

[Boris Uskov]

Hello,

try the following config on Switch 2:

monitor session 1 source interface Gi1/0/8 - 9
monitor session 1 source interface Gi2/0/8 - 9
monitor session 1 source remote vlan 999
monitor session 1 filter vlan 173
monitor session 1 destination interface Gi2/0/21

[hoffa2000]

Sorry, that doesn't work. I'm not allowed to have both remote SPAN and local SPAN as source in the same session.

/Fredrik

[Boris Uskov]

Yes, you are right. I made a mistake. The similar situation is described here:

https://supportforums.cisco.com/discussion/11094496/span-rspan

It seems, that you are not able to perform your task with the only one SPAN destination. You have to use two destinations and two different collecors: the first collector for Switch1's ports, and the second collector for Switch2's ports.

Sorry again for incorrect suggestion.

[Alexey Prilutskiy]

I think it won't work. Here is article from cisco.com - http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/network_management/configuration_guide/b_nm_15ex_2960-x_cg/b_nm_15ex_2960-x_cg_chapter_0111.html#ID199

Destination port can participate in only one SPAN session at a time (a destination port in one SPAN session cannot be a destination port for a second SPAN session).

and

Destination port can be any Ethernet physical port.