So it is a combination of SPAN and RSPAN because of the local RSPAN as a source on "same switch destination back to diff session not see traffic issue" I have seen this on 3560 / 3850 / 6500.
SWITCH 1 monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination Gi1/0/48 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/XX (can't use same port) SWITCH 2 monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880 This will work - but you need two destination ports. The only way I can think of to do it will one destination port and RSPAN is use a third switch as the destination. -----Original Message----- From: cisco-nsp [mailto:[email protected]] On Behalf Of Nick Cutting Sent: Friday, August 18, 2017 4:05 PM To: Steven Pfister <[email protected]>; [email protected] Subject: Re: [c-nsp] RSPAN and IP phones It has been a while since I have done this - but I have battled this exact setup a few times. I seem to remember that the local switch needs to have a physical span destination, i.e not the rspan vlan - needs to be a port, and only the remote switch needs the rspan destination. The second monitor session picks up the RSPAN as the source and then the port as the destination, but on the first switch. Traffic that is captured on the source and dumped into the rspan vlan, cannot be seen on the SAME switch for some reason was the limitation I think. I hope that made some kind of sense. -----Original Message----- From: cisco-nsp [mailto:[email protected]] On Behalf Of Steven Pfister Sent: Friday, August 18, 2017 2:56 PM To: [email protected] Subject: [c-nsp] RSPAN and IP phones I've got a setup at one of our sites where I've got several IP phones and a SPAN session copying traffic to them to a port on the same switch which is a call recorder. This works fine. We're recently added a second switch to this location which also serves IP phones. I'm trying to change from SPAN to RSPAN. For some reason, I either get no calls recorded, or the calls are nothing but silence. I've got vlan 880 configured as a remote-span vlan, and I'm just doing: monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination remote vlan 880 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/48 on the first switch, and monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880 vlan 880 is configured as a remote span vlan on both switches and the vlan is allowed on the trunks going to the switches. Please try our new DPS mobile app! Available in the Google Playstore (android) or Apple iTunes store. Android: https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonps&hl=en Apple: https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8 _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
