Once a network system is set-up, administrators want to monitor and collect traffic if necessary. In the past, traffic is only allowed to be collected and analyzed in that DUT (Device under Testing). It would be much trouble if Duts are far away from office, for example, 100 miles away and distributed in several places.
RSPAN solves this problem. It is a remote control mechanism that does traffic-collecting not only on that Dut but those connected to Dut. Once testing switch is connected to remote switch, RSPAN copies the packages flowed in testing switch to the remote switch. In such way, administrators could monitor several different switches by just monitoring the traffic copied to the remote switch, and could stay in remote office without travelling hundred miles away.
ES3528MV2 is a L2 Fast Ethernet Standalone Switch. It supports RSPAN and speeds up traffic-collecting. Administrators could monitor the traffic by the following steps:
How to monitor the traffic of PC1 in a different VLAN of a remote switch ?
On Switch 1
1. Create VLAN 2
SW1(config)#vlan database SW1(config-vlan)#vlan 2 media ethernet
2. Assign port 1 and port 2 to VLAN 2 access port
SW1(config)# interface ethernet 1/1-2 SW1(config-if)#switchport allowed vlan add 2 SW1(config)#switchport native vlan 2 SW1(config-if)#switchport allowed vlan remove 1 SW1(config)#exit
3. Enable RSPAN on VLAN 100
SW1(config)#vlan database SW1(config-vlan)#vlan 100 media ethernet rspan SW1(config-vlan)#exit
4. RSPAN Source device setting
SW1(config)#rspan session 1 source interface ethernet 1/1 SW1(config)#rspan session 1 remote vlan 100 source uplink ethernet 1/27
On Switch 2
1. Enable RSPAN on VLAN 100
SW2(config)#vlan database SW2(config-vlan)#vlan 100 media ethernet rspan SW2(config-vlan)#ex
2. RSPAN Destiatnion device setting
SW2(config)#rspan session 1 destination interface ethernet 1/1 tagged SW2(config)#rspan session 1 remote vlan 100 destination uplink ethernet 1/27
How to verify the RSPAN function is working or not ?
From Switch 1
SW1#sh rspan session 1 RSPAN Session ID : 1 Source Ports (mirrored ports) RX Only : None TX Only : None BOTH : Eth 1/1 Destination Port (monitor port) : None Destination Tagged Mode : None Switch Role : Source RSPAN VLAN : 100 RSPAN Uplink Ports : Eth 1/27 Operation Status : Up
SW1#sh vlan VLAN ID : 1 Type : Static Name : DefaultVlan Status : Active Ports/Port Channels : Eth1/ 3(S) Eth1/ 4(S) Eth1/ 5(S) Eth1/ 6(S) Eth1/ 7(S) Eth1/ 8(S) Eth1/ 9(S) Eth1/10(S) Eth1/11(S) Eth1/12(S) Eth1/13(S) Eth1/14(S) Eth1/15(S) Eth1/16(S) Eth1/17(S) Eth1/18(S) Eth1/19(S) Eth1/20(S) Eth1/21(S) Eth1/22(S) Eth1/23(S) Eth1/24(S) Eth1/25(S) Eth1/26(S) Eth1/27(S) Eth1/28(S) VLAN ID : 2 Type : Static Name : Status : Active Ports/Port Channels : Eth1/ 1(S) Eth1/ 2(S) Remote SPAN VLANs ------------------------------------------------ VLAN ID : 100 Type : Static Name : Status : Active
SW1#show interfaces switchport ethernet 1/1 Information of Eth 1/1 Broadcast Threshold : Enabled, 64 Kbits/second Multicast Threshold : Disabled Unknown Unicast Threshold : Disabled LACP Status : Disabled Ingress Rate Limit : Disabled, 64 Kbits per second Egress Rate Limit : Disabled, 100000 Kbits per second VLAN Membership Mode : Hybrid Ingress Rule : Disabled Acceptable Frame Type : All frames Native VLAN : 2 Priority for Untagged Traffic : 0 GVRP Status : Disabled Allowed VLAN : 2(u) Forbidden VLAN : 802.1Q Tunnel Status : Disabled 802.1Q Tunnel Mode : Normal 802.1Q Tunnel TPID : 8100 (Hex) Layer 2 Protocol Tunnel : None
SW1#show interfaces switchport ethernet 1/27 Information of Eth 1/27 Broadcast Threshold : Enabled, 64 Kbits/second Multicast Threshold : Disabled Unknown Unicast Threshold : Disabled LACP Status : Disabled Ingress Rate Limit : Disabled, 64 Kbits per second Egress Rate Limit : Disabled, 1000000 Kbits per second VLAN Membership Mode : Hybrid Ingress Rule : Disabled Acceptable Frame Type : All frames Native VLAN : 1 Priority for Untagged Traffic : 0 GVRP Status : Disabled Allowed VLAN : 1(u) Forbidden VLAN : 802.1Q Tunnel Status : Disabled 802.1Q Tunnel Mode : Normal 802.1Q Tunnel TPID : 8100 (Hex) Layer 2 Protocol Tunnel : None
From Switch 2
SW2#sh rspan session 1 RSPAN Session ID : 1 Source Ports (mirrored ports) : None RX Only : None TX Only : None BOTH : None Destination Port (monitor port) : Eth 1/1 Destination Tagged Mode : Tagged Switch Role : Destination RSPAN VLAN : 100 RSPAN Uplink Ports : Eth 1/27 Operation Status : Up
SW2#show vlan VLAN ID : 1 Type : Static Name : DefaultVlan Status : Active Ports/Port Channels : Eth1/ 1(S) Eth1/ 2(S) Eth1/ 3(S) Eth1/ 4(S) Eth1/ 5(S) Eth1/ 6(S) Eth1/ 7(S) Eth1/ 8(S) Eth1/ 9(S) Eth1/10(S) Eth1/11(S) Eth1/12(S) Eth1/13(S) Eth1/14(S) Eth1/15(S) Eth1/16(S) Eth1/17(S) Eth1/18(S) Eth1/19(S) Eth1/20(S) Eth1/21(S) Eth1/22(S) Eth1/23(S) Eth1/24(S) Eth1/25(S) Eth1/26(S) Eth1/27(S) Eth1/28(S) Remote SPAN VLANs ------------------------------------------------ VLAN ID : 100 Type : Static Name : Status : Active
SW2#sh int sw e 1/1 Information of Eth 1/1 Broadcast Threshold : Enabled, 64 Kbits/second Multicast Threshold : Disabled Unknown Unicast Threshold : Disabled LACP Status : Disabled Ingress Rate Limit : Disabled, 64 Kbits per second Egress Rate Limit : Disabled, 100000 Kbits per second VLAN Membership Mode : Hybrid Ingress Rule : Disabled Acceptable Frame Type : All frames Native VLAN : 1 Priority for Untagged Traffic : 0 GVRP Status : Disabled Allowed VLAN : 1(u) Forbidden VLAN : 802.1Q Tunnel Status : Disabled 802.1Q Tunnel Mode : Normal 802.1Q Tunnel TPID : 8100 (Hex) Layer 2 Protocol Tunnel : None
SW2#sh int sw e 1/27 Information of Eth 1/27 Broadcast Threshold : Enabled, 64 Kbits/second Multicast Threshold : Disabled Unknown Unicast Threshold : Disabled LACP Status : Disabled Ingress Rate Limit : Disabled, 64 Kbits per second Egress Rate Limit : Disabled, 1000000 Kbits per second VLAN Membership Mode : Hybrid Ingress Rule : Enabled Acceptable Frame Type : All frames Native VLAN : 1 Priority for Untagged Traffic : 0 GVRP Status : Disabled Allowed VLAN : 1(u) Forbidden VLAN : 802.1Q Tunnel Status : Disabled 802.1Q Tunnel Mode : Normal 802.1Q Tunnel TPID : 8100 (Hex) Layer 2 Protocol Tunnel : None