- [Instructor] If we have a really large
enterprise environment with multiple switches,
remote SPAN or RSPAN may be our best option
for enabling SPAN on the network.
This is going to allow the source ports for SPAN
to be located on one or multiple remote switches
and the destination port can be on a separate switch
that's connected to our traffic analyzer.
When the traffic is passed between switches,
it's going to use a special VLAN called the RSPAN VLAN
which is designated solely for RSPAN traffic.
In our topology on screen,
you can see that we have two switches connected together
by a dot one Q trunk.
There are two hosts connected to switch one
and an additional host connected to switch two.
Our traffic analyzer is connected to gig three slash three
on switch one, and what we want to do here
is to configure remote SPAN so that we can duplicate data
form our connected host on switch two
over to our traffic analyzer that's connected to switch one.
Now as I said, this requires an RSPAN VLAN to be created
dedicated solely for RSPAN traffic.
So we're already on switch one.
Let's go under global configuration mode
and let's create a VLAN.
Let's say VLAN 100
and now we're under VLAN configuration mode.
So let's give this an easily identifiable name as well.
Let's say name and I'll call it very simply RSPAN.
If we look at our main contextual help options,
you're going to see that one of those is the keyword
remote hyphen span and contextual help tells us
that this will allow us to specifically identify this
as an RSPAN VLAN, and we do want to do that.
So let me break out of our help command
and let me run the command remote hyphen SPAN,
and I'll hit enter for that.
If we exit here,
and say show
VLAN
remote hyphen SPAN,
and that's going to show us all of the remote SPAN VLANs
that we have designated,
which in our case is only that single VLAN of VLAN 100.
Now we need to create this VLAN on our other switch as well,
so let's jump over to switch number two.
And from here, we'll go under global configuration mode.
We'll say VLAN 100,
name
RSPAN,
and we'll designate that as a remote SPAN VLAN
with the command remote hyphen span.
So that all looks good.
We'll break out of there, we'll do a quick show command
just to verify that that is in place.
We do see our single remote SPAN VLAN, VLAN 100,
so that looks good.
Let's go back to switch one now.
And now we can select our local source and destination ports
with pretty much the same commands that we used
with our local SPAN configuration.
So we'll go under global configuration mode
and we'll say monitor session.
I'll call that session number one.
For the source interface,
I want to use gig zero slash one
through gig zero slash two.
We can see that in our topology.
We can also see that the traffic analyzer
is on gig three slash three,
so let's configure that as well.
Monitor session one,
destination,
interface gig three slash three.
So basically, we've set up local SPAN on this switch,
because this is the switch
that our traffic analyzer is actually connected to.
Now let's do a quick, let me break out of that
and we'll do a quick show monitor session one.
And we see that in place, we see that it is capturing
on gig zero slash one and two.
The destination port is gig three slash three,
so that's good.
Let's go over to switch two now
and continue our configuration.
From here we'll go under global configuration mode
and we can now set our source interface
exactly as we do with local SPAN.
So we'll say monitor session one,
source interface, and we can see from our topology
that it should be gig zero slash one.
We'll hit enter.
Now for the destination,
that's going to use a slightly different command
because we need to send those replicated packets
over our RSPAN VLAN to switch one.
So let's say monitor session one,
destination, and let's look at our contextual help.
So instead of our interface option
that we would typically use with local SPAN,
we want to use the remote keyword in this case
followed by the VLAN keyword,
and contextual help will tell us
that we now need to indicate which VLAN we want to use,
and of course in our case that is VLAN 100
and we could hit enter to complete that.
Now the show command is slightly different
on our remote switch.
So here on switch two, let's say show monitor session
and instead of calling out the actual session number,
if we look at our help commands,
one of those is remote
and that's the keyword that we want to use
because we are on the remote switch here.
And you can see from this output
that the remote source is gig zero slash one
and that it's going to be copying data in both directions,
both incoming and outgoing,
and the designation for the data
is the RSPAN VLAN, VLAN 100.
So now all of our SPAN data is going to cross our trunk link
from here on switch two over to switch one
where it will be delivered to the local traffic analyzer
on that particular switch.
So that's a look at configuring remote SPAN
using Cisco Catalyst switches.