RE: RSPAN

Intermediate switches don't need to have monitor sessions, but obviously DO
need that rspan transport vlan to be there..99. Also, I believe that
typical switching rules apply for those intermediate switches..in other
words, if they are cisco switches, then they need to have vlan 99 config'd
as rspan capable.if they aren't cisco switches, they might (probably will)
BLOCK the frames since mirroring traffic to a non-natural location violates
bridge tables. (perhaps you can do some sort of port mirroring trick on the
non-cisco switch to accomplish.)

About the filter thing. are you asking about this command? "monitor session
1 filter" is this what you are asking about? If so, the link below
mentions that this command is only used when (r)span is being done on a
physical source interface and not a vlan like you have in your current
config.

Aaron

Rack1SW1(config)#monitor session 1 ?

  destination SPAN destination interface or VLAN

  filter SPAN filter VLAN

  source SPAN source interface, VLAN

Rack1SW1(config)#monitor session 1 filter

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note0918
6a008015c612.shtml#charac_source

VLAN Filtering

When you monitor a trunk port as a source port, all VLANs active on the
trunk are monitored by default. You can use VLAN filtering in order to limit
SPAN traffic monitoring on trunk source ports to specific VLANs.

VLAN filtering applies only to trunk ports or to voice VLAN ports.

VLAN filtering applies only to port-based sessions and is not allowed in
sessions with VLAN sources.

From: Mohammad Khalil [mailto:eng_mssk_at_hotmail.com]
Sent: Thursday, January 26, 2012 2:35 PM
To: aaron1_at_gvtc.com; mitsuie2_at_gmail.com
Cc: ccielab_at_groupstudy.com
Subject: RE: RSPAN

Hi , thanks for the reply
no , i have configured the vlan as a remote , what am looking for is should
we use the vlan filter in order to make the monitor the vlans of concern ? i
know we are already mentioned the vlans we want in the monitor line but
checking if the filter needed ?
and in the intermediate switches we do not need to configure the monitor
sessions right ? because what we care about is the trunks in between

Thanks

> From: aaron1_at_gvtc.com
> To: eng_mssk_at_hotmail.com; mitsuie2_at_gmail.com
> CC: ccielab_at_groupstudy.com
> Subject: RE: RSPAN
> Date: Thu, 26 Jan 2012 14:21:52 -0600
>
> Not sure if this is what you are asking but it does look like you are
> missing something.
>
>
>
> I think when using rspan you will need the "remote" option on both ends to
> specify that the transport vlan is in-fact an rspan enabled vlan....which
> brings up another point....did you make the transport vlan rspan enabled?
I
> believe you must.
>
>
>
> SW1
>
> monitor session 1 source vlan 22 rx
>
> monitor session 1 source vlan 66 rx
>
> monitor session 1 destination remote vlan 99
>
>
>
> "remote" missing here..adding it in for you.
>
> SW2
>
> monitor session 1 source remote vlan 99
>
> monitor session 1 destination interface fastEthernet 0/2
>
>
>
> SW1#sh vlan remote-span
>
>
>
> Remote SPAN VLANs
>
>
----------------------------------------------------------------------------
> --
>
>
>
> SW1#conf t
>
> SW1(config)#vlan 3
>
> SW1(config-vlan)#remote-span
>
> SW1(config-vlan)#exit
>
> SW1(config)#do sh vlan remo
>
>
>
> Remote SPAN VLANs
>
>
----------------------------------------------------------------------------
> --
>
> 3
>
> SW1(config)#
>
>
>
>
>
>
>
>
>
> -----Original Message-----
> From: nobody_at_groupstudy.com [mailto:nobody_at_groupstudy.com] On Behalf Of
> Mohammad Khalil
> Sent: Thursday, January 26, 2012 2:01 PM
> To: mitsuie2_at_gmail.com
> Cc: ccielab_at_groupstudy.com
> Subject: RE: RSPAN
>
>
>
> i mean i am monitoring specific vlans traffic , should i apply the filter
> just for them ?
>
>
>
> Thanks
>
>
>
>
>
> > Subject: Re: RSPAN
>
> > From: mitsuie2_at_gmail.com
>
> > Date: Thu, 26 Jan 2012 19:15:34 +0000
>
> > CC: ccielab_at_groupstudy.com
>
> > To: eng_mssk_at_hotmail.com
>
> >
>
> > Hi Mohammad,
>
> >
>
> > Sorry I didn't get your Q. What do you mean by filtering the VLANs ?
>
> >
>
> > You use ingress to instruct the switch to which VLAN incoming traffic on
> your fa0/2 should be put into. Without that all incoming traffic is
dropped.
>
> >
>
> > /Sud
>
> >
>
> > Sent from my iPad
>
> >
>
> > On Jan 26, 2012, at 1:57 PM, Mohammad Khalil <eng_mssk_at_hotmail.com>
wrote:
>
> >
>
> > > hi , if i want to monitor traffic for a specified vlan only on one
> switch (let us say SW1) and the remote vlan is the source on the other
> switch (SW2)
>
> > > should i filter the vlans in the monitor session configuration ?
>
> > > SW1
>
> > > monitor session 1 source vlan 22 rx
>
> > > monitor session 1 source vlan 66 rx
>
> > > monitor session 1 destination remote vlan 99
>
> > >
>
> > > SW2
>
> > > monitor session 1 source vlan 99
>
> > > monitor session 1 destination interface fastEthernet 0/2 (should i use
> ingress ? the f0/2 is not access in any vlan)
>
> > >
>
> > > Thanks
>
> > >
>
> > > BR,
>
> > > MSSK
>
> > >
>
> > >
>
> > > Blogs and organic groups at http://www.ccie.net
>
> > >
>
> > >
Received on Thu Jan 26 2012 - 15:03:11 ART