SPAN and RSPAN with 2x 3560-CX configuration question

[Paul Flint]

I have two 3560 in separate buildings connected by a fibre using SFP port 2
I want to monitor all traffic on both switches using a device connected to switch 1

switch 1
Gi0/1 to Gi0/8 Vlan 1
Gi0/9 to Gi0/12 Vlan 2
Gi0/16 SFP fibre link to switch 2/Gi0/16

switch 2
GI0/1 to GI0/8 Vlan 1
Gi0/16 SFP fibre link to switch 1/Gi0/16

It is my understanding that in order to monitor traffic from both switches I would need to use a span session on switch 1 and an RSPAN on switch 2.
If my monitor device is connected to switch 1, will I need to use two ports to connect to it, one for each session. (Gi0/13 & 14)
If yes, could this be avoided using vlan instead of ports or alternatively if the switches were stacked I could just use a SPAN session?

[liviu.gheorghe]

Hello @Paul Flint ,

---

It is my understanding that in order to monitor traffic from both switches I would need to use a span session on switch 1 and an RSPAN on switch 2.

That is correct.

If my monitor device is connected to switch 1, will I need to use two ports to connect to it, one for each session. (Gi0/13 & 14)
If yes, could this be avoided using vlan instead of ports or alternatively if the switches were stacked I could just use a SPAN session?

---

Yes, you will have to configure 2 monitor sessions, one for the ports in switch 1 and one for the RSPAN, each with their separate destination port in switch 1.

You cannot avoid having two monitoring sessions. You could use vlans as the source for monitoring, but you cannot combine vlans on switch 1 with remote vlan used for RSPAN.

If the switches where stacked, then it would be a single virtual switch and you could have just one monitor session because you wouldn't need the RSPAN.

Hope this helps.