RSPAN not Working

[Tarek Assaf]

Hello,

I have configured Remote SPAN on switches in our network but it is not working. i tried debugging it but no output. However, i tested the SPAN on the Core and it worked fine.

Core Configuration:

monitor session 2 destination interface Gi4/20

monitor session 2 source remote vlan 901

monitor session 2 filter packet-type good rx

Access Cofiguration:

monitor session 2 source interface Fa0/3 , Fa0/9 , Fa0/18 , Fa0/23 , Fa0/30 , Fa0/37 , Fa0/43

monitor session 2 filter vlan 8

monitor session 2 destination remote vlan 901

I've created the Vlan 901 for RSPAN.

[manish arora]

Check the output of "show  vlan remote-span" on all of the switches, out put should show "901" and make your that this vlan is allowed on the Trunk links and excluded from pruning as well.

Post the output of "show monitor session X" from your switches if your configuration checks out correctly.

[Tarek Assaf]

pruning is not enabled on the switches and in the " show vlan remote-span" i can see the vlan 901.

the " show monitor session 2 " output is below:

Core Switch:

Session 2
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 901
Destination Ports      : Gi4/20
    Encapsulation      : Native
          Ingress      : Disabled
         Learning : Disabled
Filter Pkt Type        :
    RX Only       : Good

Access Switch:
Session 2
---------
Type                   : Remote Source Session
Source Ports           :
    Both               : Fa0/3,Fa0/9,Fa0/18,Fa0/23,Fa0/30,Fa0/37,Fa0/43
Filter VLANs           : 8
Dest RSPAN VLAN        : 901

[manish arora]

Try removing the Filter packet-type good configuration from your core switch and see if you receive any traffic.

also out of curiosity, how are you checking the mirrored traffic ? 

Manish 

[Tarek Assaf]

I've removed the filter packet-type but same results. 

I have a recording server and i have tested it on the  Core as a SPAN it worked and started recording and I've captured traffic but when i try it as RSPAN it doesn't capture ant traffic.

[manish arora]

Hi Tarek,

Can you please try the following on the Access switch (in Maintenance window of course ) :

monitor session 2 destination remote vlan 901  reflector-port gigX/X

Where gigX/X is the trunk port ( uplink) from access to the core switch.

Ref: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-1_13_ea1/configuration/guide/3550scg/swspan.html#wp1075592

Thanks

Manish

[Tarek Assaf]

Hi Manish,

The IOS version available on switch doesn't support  reflector-port gigX/X, and the customer doesn't want to upgrade the IOS unless it is the last solution.

[devils_advocate]

Is your destination a Trunk port?

If so, you need to specify the encapsulation type.

monitor session 2 destination interface Gi4/20 encapsulation dot1q

If you do not set the encapsulation type, I believe the default setting simply outputs frames which are part of the native vlan. 

[Tarek Assaf]

for the Access my Destination is the Vlan and for the Core my Destination is an access port.