Remote Switch Port Analyzer (RSPAN) Related Configuration

Cisco switches support a method of directing a copy of all traffic from a source port or source VLAN to a single port on a remote switch. This feature is called RSPAN..

In RSPAN you create a source that consists of at least one port or at least one VLAN on a switch. Destination for this session is the RSPAN VLAN. That special VLAN can be extended across a switched network to transport the directed copy of traffic to receive on a destination RSPAN port.

Let's see an example configuration..

Going to capture SW-3's e0/2 traffic and export to the destination port on SW-1's e0/3..

Note: Ethernet interfaces will be FastEthernet interfaces in configuration as I am doing this on a actual Cisco 2960 switch..

Configuration in SW-3

Creating RSPAN VLAN;
SW-3(config)#vlan 99
SW-3(config-vlan)#remote-span

Defining source port & destination RSPAN VLAN;
SW-3(config)#monitor session 3 source interface fa0/2
SW-3(config)#monitor session 3 destination remote vlan 99

Allowing RSPAN VLAN on Trunk;
SW-3(config)#int fa0/3
SW-3(config-if)#switchport trunk allowed vlan add 99

Configuration in SW-2

Creating VLAN;
SW-2(config)#vlan 99

Allowing RSPAN VLAN on Trunk;
SW-2(config)#int range fa0/2-3
SW-2(config-if-range)#switchport trunk allowed vlan add 99

Configuration in SW-1

Creating RSPAN VLAN;
SW-1(config)#vlan 99
SW-1(config-vlan)#remote-span 

Defining source port & destination RSPAN VLAN;
SW-1(config)#monitor session 1 source remote vlan 99
SW-1(config)#monitor session 1 destination interface fa0/3

Issuing show monitor session command on SW-3 & SW-1;

Now let's take a more complex example where a combination of VLANs and ports are to be monitored. SPAN restricts sourcing VLANs & ports to a same session in a same switch but the following is possible when the ports and VLANs to be monitored are in different switches.

In this example SW-3's e0/2 traffic and VLAN 3 traffic in SW-2 should be exported to the destination port on SW-1's e0/3..

You just need to make VLAN 99 on SW-2 to be a RSPAN VLAN instead of a normal VLAN and define the source VLAN..

Making VLAN 99 a RSPAN VLAN;
SW-2(config)#vlan 99
SW-2(config-vlan)#remote-span

Defining source VLAN & destination RSPAN VLAN;
SW-2(config)#monitor session 2 source vlan 3
SW-2(config)#monitor session 2 destination remote vlan 99

Issuing show monitor session command on SW-2;