RSPAN configuration

[Stephane ARDHUIN]

Hi,

I'm trying to configure a RSPAN with multiple source ports on multiple switches and 1 destination port.

On the first switch I have :

Session 1
---------

Type                   : Remote Source Session

Source Ports           :
    Both               : Po2
Dest RSPAN VLAN        : 400

On the second switch I have :

Session 1
---------

Type                   : Remote Source Session

Source Ports           :
     Both               : Po2
Dest RSPAN VLAN        : 400

Session 2
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 400
Destination Ports      : Gi0/7
    Encapsulation      : Native
          Ingress      : Disabled

I don't get any error message, but the counters of interface gi0/7 all remain at 0.

I guess the source & destination RSPAN on the same switch are not supported.

I'm looking for a workaround.

any idea ?

Thanks

Stéph.

[Giuseppe Larosa]

Hello Stephane,

try to remove session 1 on switch 2

the idea about RSPAN is that of having sources on first switch, a chain of switches in the middle, a final switch where the destination is connected.

To be honest this may be also platform dependent, someone has reported to be able to do this (having multiple sources on the path) but when using all C6500 switches.

on second switch you can have a separate local session with source and destination on switch2.

Hope to help

Giuseppe

[Stephane ARDHUIN]

Thanks for your help,

In this case i'm trying to monitor 2 servers in HA, the first is on a remote switch and the second is on the same switch then the sniffer.

I want the traffic form both servers on a single sniffer interface (ie gi0/7 of switch#2).

When I try to configure 2 sessions on switch 2 (1local & 1remote) I get the following message :

% Cannot add RSPAN VLAN as source for SPAN session 2 as it is not a RSPAN Destination session.

To be honnest, I'm not sure to understand it ...

If I configure the destination monitor session on a 3rd switch it works fine. But I would have to move my sniffer server which isn't possible fr the moment.

Stéph.

[Shashank Singh]

Hi Stephane,

The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches. This Vlan is trunked to a remote switch which uses the vlan as the source and a local physical interface as the final destination interface connecting the sniffer.

Keeping this in mind it is impossible for RSPAN to have source and destination on same switch. Also, any interface can be the destination for at most one SPAN session. Hence in your case, its impossible to configure a common destination for the local SPAN and the RSPAN. There have to be at least two different interfaces acting as the destination for these SPAN sessions.

Cheers,

Shashank

Please rate if you found the content useful

[twgraham]

This is the info I was looking for:

its impossible to configure a common destination for the local SPAN and the RSPAN

Thanks.