[c-nsp] RSPAN and IP phones

[Steven Pfister]

Thank you... that's kind of what I was suspecting.
>>> Nick Cutting <ncutting at edgetg.com> 8/18/2017 5:02 PM >>>
So it is a combination of SPAN and RSPAN 
because of the local RSPAN as a source on "same switch destination back
to diff session not see traffic issue"  I have seen this on 3560 / 3850
/ 6500.


SWITCH 1
monitor session 1 source interface Gi1/0/1 - 24 
monitor session 1 destination Gi1/0/48
monitor session 2 source remote vlan 880 
monitor session 2 destination interface Gi1/0/XX (can't use same port)

SWITCH 2

monitor session 1 source interface Gi1/0/1 - 6 
monitor session 1 destination remote vlan 880


This will work - but you need two destination ports.
The only way I can think of to do it will one destination port and
RSPAN is use a third switch as the destination.


-----Original Message-----
From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of
Nick Cutting
Sent: Friday, August 18, 2017 4:05 PM
To: Steven Pfister <SPfister at dps.k12.oh.us>; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] RSPAN and IP phones

It has been a while since I have done this - but I have battled this
exact setup a few times.

I seem to remember that the local switch needs to have a physical span
destination, i.e not the rspan vlan - needs to be a port, and only the
remote switch needs the rspan destination.
The second monitor session picks up the RSPAN as the source and then
the port as the destination, but on the first switch.

Traffic that is captured on the source and dumped into the rspan vlan,
cannot be seen on the SAME switch for some reason was the limitation I
think. 

I hope that made some kind of sense.

-----Original Message-----
From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of
Steven Pfister
Sent: Friday, August 18, 2017 2:56 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] RSPAN and IP phones

I've got a setup at one of our sites where I've got several IP phones
and a SPAN session copying traffic to them to a port on the same switch
which is a call recorder. This works fine.

We're recently added a second switch to this location which also serves
IP phones. I'm trying to change from SPAN to RSPAN. For some reason, I
either get no calls recorded, or the calls are nothing but silence.

I've got vlan 880 configured as a remote-span vlan, and I'm just
doing:

monitor session 1 source interface Gi1/0/1 - 24 monitor session 1
destination remote vlan 880 monitor session 2 source remote vlan 880
monitor session 2 destination interface Gi1/0/48

on the first switch, and 

monitor session 1 source interface Gi1/0/1 - 6 monitor session 1
destination remote vlan 880

vlan 880 is configured as a remote span vlan on both switches and the
vlan is allowed on the trunks going to the switches.

Please try our new DPS mobile app!   Available in the Google Playstore
(android) or Apple iTunes store.  Android:
https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonps&hl=en
Apple:
https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Please try our new DPS mobile app!   Available in the Google Playstore
(android) or Apple iTunes store.  Android:
https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonps&hl=en
 Apple:
https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8