I am trying to figure out the best/correct way to configure a SPAN session for multiple sources to 1 destination. We have 2 7ks with vPCs going to 2 5ks. We only have 1 SPAN session available (1 in use, not currently able to upgrade the NX-OS to newer version to allow for 14). Here is a brief description/configuration
We have multiple remote sites that come in via 2 interfaces
Eth9/4
Eth1/25.224
Most of the remote sites are using Citrix which uses vlan 104.
The traffic destination we wish to capture is going out vlan 28.
Vlan 104 uses port-channel 15, which is configured as vPC 15
Vlan 28 uses port-channel 55, whichch is configured as vPC 55
I'm curious if this would SPAN the traffic
!on the 7k primary
monitor session 1
description Fluke TruView SPAN
source vlan 28 both
source vlan 104 both
source interface ethernet10/25 both
filter vlan 28,104,224
destination interface Ethernet1/25
But that would not SPAN any traffic traversing 7k secondary. From my research I would need to setup ERSPAN on the 7k secondary, but from what I see I need to configure the 7k primary as an ERSPAN destination using
monitor session 1 type erspan-destination
Is it possible to achieve my desired results with only 1 available span session or would I need 2 available span sessions and configure one as an ERSPAN destination and one as a normal SPAN session?
Thank you for any guidance anyone can provide.
