cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1114
Views
15
Helpful
9
Replies

RSPAN Problems

MattSherman5680
Level 1
Level 1

Hello, 

I have a simple RSPAN setup between two 3560 switches.  All ports are in VLAN 1.  When I try to monitor VLAN 1 as a source I lose all connectivity to the remote switch as soon as I enable the RSPAN.  If I use physical ports as the source traffic the connectivity stays up but the only traffic I see on the remote capture port is broadcast and multicast.  Any ideas on what I'm doing wrong?

 

Source Switch

vlan 902
remote-span

!

monitor session 1 source interface Gi0/43
monitor session 1 destination remote vlan 902

 

#show monitor
Session 1
---------
Type : Remote Source Session
Source Ports :
Both : Gi0/43
Dest RSPAN VLAN : 902

 

#sh int trunk

Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1

Port Vlans allowed on trunk
Gi0/1 1-4094

Port Vlans allowed and active in management domain
Gi0/1 1-3,5-9,90,100,902

Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1-3,5-9,90,100,902

 

Destination Switch

vlan 902
remote-span

!

monitor session 1 destination interface Gi0/6
monitor session 1 source remote vlan 902

 

#show monitor
Session 1
---------
Type : Remote Destination Session
Source RSPAN VLAN : 902
Destination Ports : Gi0/6
Encapsulation : Native
Ingress : Disabled

 

#show int trunk

Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1

Port Vlans allowed on trunk
Gi0/1 1-4094

Port Vlans allowed and active in management domain
Gi0/1 1-3,902

Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1-3,902

9 Replies 9

balaji.bandi
Hall of Fame
Hall of Fame

Do you have network topology how these Switches connected ? like Source Switch and Designation SPAN port.

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Hi,

Yes, see attached.  I changed the VLAN from 1 to 2 on the assumption that it might be a native VLAN thing but didn't make a difference. 

 

RSPAN.jpg

just checking is this a real world setup or any simulation lab ?

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

It's real

Hello

Once a destination port is a part of a span session it doesn't work as a normal switchport port anymore , so try defaulting interface gig0/6 on sw2, then test again.


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Hi,

 

I tried it and it didn't make a difference. 

 

Thanks,

Matt

Hello

Can you also try specifying the ingress vlan

Sw2
monitor session 1 destination interface Gi0/6 ingress vlan 2


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

 

Hi,

 

I believe that the ingress setting just allows the capture host on that port to actually use the port for access at the same time.  I have tried that and still the same problem - only seeing broadcast/multicast as shown below:

 

RSPAN2.jpg

Hello MattSherman5680,

 

Is the capturing device capable of capturing traffic in promiscuous mode?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card