[c-nsp] RSPAN and IP phones

[Nick Cutting]

So it is a combination of SPAN and RSPAN 
because of the local RSPAN as a source on "same switch destination back to diff session not see traffic issue"  I have seen this on 3560 / 3850 / 6500.


SWITCH 1
monitor session 1 source interface Gi1/0/1 - 24 
monitor session 1 destination Gi1/0/48
monitor session 2 source remote vlan 880 
monitor session 2 destination interface Gi1/0/XX (can't use same port)
 
SWITCH 2
 
monitor session 1 source interface Gi1/0/1 - 6 
monitor session 1 destination remote vlan 880


This will work - but you need two destination ports.
The only way I can think of to do it will one destination port and RSPAN is use a third switch as the destination.


-----Original Message-----
From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Nick Cutting
Sent: Friday, August 18, 2017 4:05 PM
To: Steven Pfister <SPfister at dps.k12.oh.us>; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] RSPAN and IP phones

It has been a while since I have done this - but I have battled this exact setup a few times.

I seem to remember that the local switch needs to have a physical span destination, i.e not the rspan vlan - needs to be a port, and only the remote switch needs the rspan destination.
The second monitor session picks up the RSPAN as the source and then the port as the destination, but on the first switch.

Traffic that is captured on the source and dumped into the rspan vlan, cannot be seen on the SAME switch for some reason was the limitation I think. 

 I hope that made some kind of sense.

-----Original Message-----
From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Steven Pfister
Sent: Friday, August 18, 2017 2:56 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] RSPAN and IP phones

I've got a setup at one of our sites where I've got several IP phones and a SPAN session copying traffic to them to a port on the same switch which is a call recorder. This works fine.
 
We're recently added a second switch to this location which also serves IP phones. I'm trying to change from SPAN to RSPAN. For some reason, I either get no calls recorded, or the calls are nothing but silence.
 
I've got vlan 880 configured as a remote-span vlan, and I'm just
doing:
 
monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination remote vlan 880 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/48
 
on the first switch, and 
 
monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880
 
vlan 880 is configured as a remote span vlan on both switches and the vlan is allowed on the trunks going to the switches.

Please try our new DPS mobile app!   Available in the Google Playstore
(android) or Apple iTunes store.  Android:
https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonps&hl=en
 Apple:
https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/