Re: SPAN/RSPAN question

That won't work. To quote your previous quote:

"an RSPAN source session cannot have a local
destination port, an RSPAN destination session cannot have a local
source port"

On Thu, Jun 28, 2012 at 5:10 PM, Leigh Finch <leigh_at_leighfinch.net> wrote:

> Sorry, just woke up.
>
> Even better set switch 1 to dump to rspan as well.
>
> SW1:
>
> monitor session 1 source interface Fa0/19
> monitor session 1 destination remote vlan 150
> monitor session 2 source remote vlan 150
> monitor session 2 dest int fa0/10
>
> SW2:
>
> monitor session 1 source interface Fa0/19
> monitor session 1 destination remote vlan 150
>
>
> Should do the trick.
>
> leigh
>
>
> On 29/06/12 7:35 AM, Leigh Finch wrote:
>
>> Hi Johnny,
>> From the DOC CD:
>>
>> http://www.cisco.com/en/US/**docs/switches/lan/**
>> catalyst3560/software/release/**12.2_44_se/configuration/**
>> guide/swspan.html#wp1210541<http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_44_se/configuration/guide/swspan.html#wp1210541>
>>
>> " The switch does not support a combination of local SPAN and RSPAN in a
>> single session. That is, an RSPAN source session cannot have a local
>> destination port, an RSPAN destination session cannot have a local
>> source port, and an RSPAN destination session and an RSPAN source
>> session that are using the same RSPAN VLAN cannot run on the same switch.
>> "
>>
>> On destination ports,
>>
>> " It can participate in only one SPAN session at a time (a destination
>> port in one SPAN session cannot be a destination port for a second SPAN
>> session). "
>>
>> I would be looking at running another port up from you switch to your
>> capture server for the rspan.
>>
>> leigh
>>
>> On 29/06/12 2:19 AM, Johnny Morris wrote:
>>
>>> Hi All,
>>>
>>> 1 - Monitoring Server
>>> 2 - Cisco 3560 switches
>>> 2 - ASA's in active/standby mode
>>>
>>>
>>> I have one monitoring server configured to capture SPAN traffic connected
>>> to the primary switch fa0/19. The monitoring destination port is fa0/10
>>> on
>>> the primary switch. The primary switch is etherchannel to the secondary
>>> switch via g0/1-2. There inside interface of the Active ASA is connected
>>> to
>>> fa0/19 Primary switch and Standby on secondary switch fa0/19.
>>>
>>> Currently SPAN is working on the primary device, however in failover
>>> environment I have noticed that RSPAN is not configure to capture the
>>> fa0/19 on the secondary switch. When I labbed this up and configured an
>>> RSPAN vlan on both switches and added the RSPAN vlan to the MST instance
>>> I
>>> then configured the following:
>>>
>>> SW1:
>>>
>>> Existing SPAN configs:
>>>
>>> !
>>> monitor session 1 source interface Fa0/19
>>> monitor session 1 destination interface Fa0/10
>>> !
>>>
>>> SW2:
>>>
>>> !
>>>
>>> monitor session 1 source interface Fa0/19
>>>
>>> monitor session 1 destination remote vlan 150
>>> !
>>>
>>> Attempt 1:
>>>
>>> Tried to add the following RSPAN source on SW1:
>>>
>>> monitor session 1 source remote vlan 150
>>>
>>> Received error:
>>>
>>> (config)#monitor session 1 source remote vlan 150
>>> % Cannot add RSPAN VLAN as source for SPAN session 1 as it is not a RSPAN
>>> Destination session
>>>
>>> Attempt 2:
>>>
>>> tried to add a second monitor session and it also failed:
>>>
>>> Great_Bend-SW1(config)#monitor session 2 source remote vlan 150
>>> Great_Bend-SW1(config)#monitor session 2 dest int fa0/10
>>> % Interface(s) Fa0/10 already configured as monitor destinations in other
>>> monitor sessions
>>>
>>>
>>>
>>> Is there a way anyone can think of to monitor a local source interface
>>> and
>>> remote vlan using the same destination? Is there an issue as to why it
>>> cannot be done or is this something Cisco should update/allow in an IOS
>>> code? I don't have an additional NIC on the monitoring server to monitor
>>> otherwise it would work.
>>>
>>>
>>> Much appreciated !
>>>
>>>
>>> Blogs and organic groups at http://www.ccie.net
>>>
>>> ______________________________**______________________________**
>>> ___________
>>> Subscription information may be found at:
>>> http://www.groupstudy.com/**list/CCIELab.html<http://www.groupstudy.com/list/CCIELab.html>
>>>
>>
>> Blogs and organic groups at http://www.ccie.net
>>
>> ______________________________**______________________________**
>> ___________
>> Subscription information may be found at:
>> http://www.groupstudy.com/**list/CCIELab.html<http://www.groupstudy.com/list/CCIELab.html>
>>
>
>
> Blogs and organic groups at http://www.ccie.net
>
> ______________________________**______________________________**
> ___________
> Subscription information may be found at: http://www.groupstudy.com/**
> list/CCIELab.html <http://www.groupstudy.com/list/CCIELab.html>
>
>
>
>
>
>
>
>

-- 
Marc Abel
CCIE #35470
(Routing and Switching)
Blogs and organic groups at http://www.ccie.net