Posted May 10, 2005 by jotfco in Cisco switch

This guide can be useful if you need to configure the RSPAN session on your Catalyst 6500. In this example, we will see how to monitor more than one VLAN using the RSPAN VLAN. RSPAN has all the features of SPAN plus support for source ports and destination ports distributed across multiple switches. This allows remote monitoring of multiple switches across your network. The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches. The SPAN traffic from the sources, which cannot be in the RSPAN VLAN, is switched to the RSPAN VLAN and then forwarded to destination ports configured in the RSPAN VLAN. The traffic type for sources (ingress, egress, or both) in an RSPAN session can be different in different source switches, but it is the same for all sources in each source switch for each RSPAN session. Do not configure any ports in an RSPAN VLAN except those selected to carry RSPAN traffic. Learning is disabled on the RSPAN VLAN.

Assume that we have a network with many VLANs and a VTP domain. For this example, I consider two core switches (CAT6506), intermediates switches (various Catalyst), and the final switched (where the user is connected to analyze the traffic).

First of all, you must configure (on the Core Switch) an RSPAN VLAN that will be propagated by the vtp domain to the other switches:

Switch>(enable) set vlan 36 rspan

Then, we can configure the RSPAN session:

Switch>(enable) set rspan source 10 36

The VLAN 10 is the VLAN that must be monitored.

Now, on the catalyst where we are connected, we must configure the RSPAN destination:

Switch>(enable) set rspan destination 3/48 36

Specifying the destination port 3/48 (our port), we can monitor the VLAN 10 that is carried by the RSPAN VLAN 36.

This operation can be performed for all the VLANs on the network, but remember that you can open only one RSPAN session. Therefore, you need to monitor the traffic, disable the source for the VLAN, create a new source VLAN and restart the process.

To disable the RSPAN in source/destination, use these commands:

Switch>(enable) rspan disable source all
Switch>(enable) rspan disable destination all

When you have finished capturing the traffic, remember to remove the RSPAN VLAN.


The Conversation

Follow the reactions below and share your own thoughts.