Cisco IOS SPAN and RSPAN

(Lazaros Agapides) #21

Hello Edi

Yes, a SPAN destination port can be configured as trunks or access ports. Keep in mind that by using one or the other, there will be no difference in what is outputted.

Having said that, however, if your source port is a trunk, frames on that trunk will be tagged with the appropriate VLAN ID. Frames that will be outputted from the SPAN destination port will NOT have these tags UNLESS it is configured as a trunk port AND the encapsulation dot1q is enabled.

For example, if you create a SPAN monitor session 1, and you view this session with the commands below, you can see the encapsulation on the destination port is set to Native.

Switch#show monitor session 1
Session 1
---------
Type                   : Local Session
Source Ports           : 
    Both               : Fa0/24
Destination Ports      : Fa0/1
    Encapsulation      : Native
          Ingress      : Disabled
 
 Switch#

If the destination port Fa0/1 is configured to be a trunk AND is configured with dot1q encapsulation, then the tags will be included.

I hope this has been helpful!

Laz

(Networklessons Admin) split this topic #22

19 posts were merged into an existing topic: Cisco IOS SPAN and RSPAN

(Vitaly K) #23

Hello,
I have two 3750 trunked with gi ethernchannel.
VTP enabled. SW1 is VTP client and is a source for RSPAN. VLAN 20 is only enabled.

SW2 is the destination for RSPAN source traffic, it is the VTP Server.

I tried VLAN 20 and got expected message: %VTP VLAN configuration not allowed when device is in CLIENT mode.
That prevents me to execute the next command remote span under for VLAN 20 on VTP client. Please add more content to your RSPAN example explaining how to enable RSPAN on VTP client.

(jonrandall) #24

Hi @alcornet,

Have you created your RSPAN VLAN(s) on a VTP server? You can apply the “remote-span” parameter as normal that way.
Also do be careful to check VTP pruning; it can remove RSPAN VLANs!

I have placed some example configuration below that I hope is useful.

Kind regards,
Jon

CiscoCat2970#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
CiscoCat2970(config)#vtp ver 2      
VTP mode already in V2.
CiscoCat2970(config)#vtp mode server
Device mode already VTP SERVER.
CiscoCat2970(config)#vlan 20
CiscoCat2970(config-vlan)#remote-span
CiscoCat2970(config-vlan)#exit
CiscoCat2970(config)#exit
CiscoCat2970#show vlan id 20

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
20   VLAN0020                         active    

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
20   enet  100020     1500  -      -      -        -    -        0      0   

Remote SPAN VLAN
----------------
Enabled

Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

CiscoCat2970#
(Abhishek D) #25

Hi Rene
The example you used , is for a layer2 network. I mean you have not used any IP addresses etc.
what if we have a layer-3 network? For example we have a core router , aggregating lot of access switches and running eigrp routing. if we need to enable port analyzer still need to create vlan ?

Thanks
Abhishek

(Rene Molenaar) #26

Hi Abhishek,

SPAN and RSPAN are used to capture on L2 so anything on the upper layers, is also captured. You can use this on an interface that connects to a router to capture whatever you need.

It’s also possible to capture traffic on a router btw:

(AZM U) #27

Hello Rene,
I need some help and I am going to use the below topology as the reference.

image
image.png1393×576 7.45 KB

In this switch I have two VLANs(VLAN 10 and VLAN 20). G1/1 is an access port assigned to VLAN 10 and G2/2 is also an access port assigned to VLAN 20. Now I want to connect two packet sniffing devices on port G3/3 and port G4/4 and they will use IP addresses from VLAN 10.

This will be the configuration:
========================

monitor session 1 source vlan 10 ,  20
monitor session 1 destination interface G3/3
monitor session 1 destination interface G4/4

But the question is How should I configure those two ports(G3/3 and G4/4) that are going to be connected to sniffing devices?

Can I configure them regular access port and assign them to VLAN 10?

interface GigabitEthernet3/3
 switchport access vlan 10
 switchport mode access

interface GigabitEthernet4/4
 switchport access vlan 20
 switchport mode access

Thanks in advance.

Best Regards,
Azm

(Lazaros Agapides) #28

Hello AZM

First of all, it doesn’t really matter what IP addresses you configure on the packet sniffers. These devices will not be able to communicate with the network as their sole purpose is to sniff or detect any and all packets that are sent from the destination ports.

Secondly, the destination ports have all ingress traffic disabled, so even if they were configured with additional parameters, these are all overridden.

Essentially, no additional parameters are necessary on the destination ports.

You can find additional comprehensive information about the destination ports in a SPAN configuration at this Cisco documentation.

I hope this has been helpful!

Laz

(AZM U) #29

Hello Laz,
Thank you as usual. Here is another question and the below diagram will be used as a reference.

image
image.png1355×539 8.4 KB

  1. What would be the configuration for SW-1?

Azm

(Lazaros Agapides) #30

Hello AZM

This is a very good question. Essentially, what you want to do with the above topology is to have the destination port receive monitoring information from both SPAN and RSPAN source ports.

According to Cisco:

The switch does not support a combination of local SPAN and RSPAN in a single session. That is,
an RSPAN source session cannot have a local destination port, an RSPAN destination session cannot
have a local source port, and an RSPAN destination session and an RSPAN source session that are
using the same RSPAN VLAN cannot run on the same switch.

So you will need to have two separate destination ports, one for the locally monitored source ports and one for the remotely monitored source ports.

The above text was taken from this Cisco documentation, page 23-4.

I hope this has been helpful!

Laz

(AZM U) #31

You the man Laz…

(Lazaros Agapides) #32

Always happy to help AZM!!

Laz

(Jason W) #33

In your example - “Switch(config)#monitor session 1 destination interface fa0/2” I did that on my switch. I could not locate fa0/2 in show vlan or show int trunk. a show int fa0/2 switchport show operation mode : down a show int fa0/2 showed line protocol is down (monitoring). Does configuring fa0/2 as a destination in SPAN create all this?

(Lazaros Agapides) #34

Hello Jason

When a port is configured as a destination port for SPAN/RSPAN, it no longer functions as a regular switchport. Indeed, it no longer shows up in the show VLAN or show interface trunk commands because it is neither an access or trunk port. The operation mode is down because the only other options are trunk or access, and it is none of those. The line protocol (Ethernet) is also down because it is not functioning as an Ethernet port. It is in a specialised state where it just sends copies of frames from the appropriate sources.

So to answer your question, yes, all of this is due to the configuration of the port as a monitoring port.

I hope this has been helpful!

Laz