Multiple RSPAN Vlan and send to Destination interface

[Himanshu_Dwivedi]

I am dealing with the scenario where customers has multiple switches and they want that all the switches use different VLAN for RSPAN i.e SW1 Vlan 10, SW2 Vlan 20 and so on. I have sniffer connect to the main switch, is there any possibility to get multiple RSPAN Vlan as source and destination to Sniffer port like

Monitor session 1 source remote vlan id1, id2( unable to paas multiple vlan as it is not supported)

Monitor session 1 destination interface Gig1/0/24

Will I get the data if I do below config

Monitor session 1 source vlan id1 , id2 , nnn

Monitor session 1 destination interface Gig1/0/24

[balaji.bandi]

From the Source Switches you use below example :

Example :

SW1.

monitor session 1 source vlan 10
monitor session 1 destination remote vlan 100 (this is vlan for RSPAN)

On the destination RSPAN SWITCH

monitor session 1 source remote vlan 100
monitor session 1 destination interface gig1/0/24 (this where your PC connection)

Same config will be applied in SW2 with VLAN 20 and so on.

Note : make sure vlan 100 allowed in the trunk port.

check some example :

https://www.balajibandi.com/?p=2501

[Himanshu_Dwivedi]

Hello , thank you for the response, but I have some different scenarios, please find the below 

SW2

monitor session 1 source vlan 20
monitor session 1 destination remote vlan 101 (this is vlan for RSPAN)

On the destination RSPAN SWITCH

monitor session 1 source remote vlan 101 (I think this will overwrite vlan 100 config but I want to keep 100 as well)
monitor session 1 destination interface gig1/0/24 (this where your PC connection)

Same config will be applied in SW2 with VLAN 20 and so on.

[balaji.bandi]

Technically, that should - as example below :

SW1

monitor session 1 source vlan 10
monitor session 1 destination remote vlan 100 (this is vlan for RSPAN)

SW2

monitor session 1 source vlan 20
monitor session 1 destination remote vlan 100 (this is vlan for RSPAN)

remote Switch :

On the destination RSPAN SWITCH

monitor session 1 source remote vlan 100
monitor session 1 destination interface gig1/0/24 (this where your PC connection)

check configuration guide lines based on the switch :

https://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3.2_0_se/multibook/configuration_guide/b_consolidated_config_guide_3850_chapter_01101101.html

[Himanshu_Dwivedi]

Thank you,

Seems like we cannot pass multiple remote vlan as source switch where sniffer is connected to.

[balaji.bandi]

If the remote Wireshark has dual interfaces, you can connect two Interfaces to the switch and use two monitor sessions. If that does not work, there is another option.

If I get a chance, let me test in the lab.