Re: [c-nsp] RSPAN and IP phones
I'm trying this now. I've got the destination port on a third switch. The two switches with phones on them are using RSPAN. The phones on the switch that used to have the destination port are still getting to the recorder server, but not the other switch. All trunks are allowing the RSPAN VLAN, and all switches have it defined. The switch that's working also has the management port connected to it. That shouldn't make a difference, should it? >>> Nick Cutting <ncutt...@edgetg.com> 8/18/2017 5:02 PM >>> So it is a combination of SPAN and RSPAN because of the local RSPAN as a source on "same switch destination back to diff session not see traffic issue" I have seen this on 3560 / 3850 / 6500. SWITCH 1 monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination Gi1/0/48 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/XX (can't use same port) SWITCH 2 monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880 This will work - but you need two destination ports. The only way I can think of to do it will one destination port and RSPAN is use a third switch as the destination. -Original Message- From: cisco-nsp [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Nick Cutting Sent: Friday, August 18, 2017 4:05 PM To: Steven Pfister <spfis...@dps.k12.oh.us>; cisco-nsp@puck.nether.net Subject: Re: [c-nsp] RSPAN and IP phones It has been a while since I have done this - but I have battled this exact setup a few times. I seem to remember that the local switch needs to have a physical span destination, i.e not the rspan vlan - needs to be a port, and only the remote switch needs the rspan destination. The second monitor session picks up the RSPAN as the source and then the port as the destination, but on the first switch. Traffic that is captured on the source and dumped into the rspan vlan, cannot be seen on the SAME switch for some reason was the limitation I think. I hope that made some kind of sense. -Original Message- From: cisco-nsp [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Steven Pfister Sent: Friday, August 18, 2017 2:56 PM To: cisco-nsp@puck.nether.net Subject: [c-nsp] RSPAN and IP phones I've got a setup at one of our sites where I've got several IP phones and a SPAN session copying traffic to them to a port on the same switch which is a call recorder. This works fine. We're recently added a second switch to this location which also serves IP phones. I'm trying to change from SPAN to RSPAN. For some reason, I either get no calls recorded, or the calls are nothing but silence. I've got vlan 880 configured as a remote-span vlan, and I'm just doing: monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination remote vlan 880 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/48 on the first switch, and monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880 vlan 880 is configured as a remote span vlan on both switches and the vlan is allowed on the trunks going to the switches. Please try our new DPS mobile app! Available in the Google Playstore (android) or Apple iTunes store. Android: https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonps=en Apple: https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8 ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ Please try our new DPS mobile app! Available in the Google Playstore (android) or Apple iTunes store. Android: https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonpshl=en Apple: https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8 ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: [c-nsp] RSPAN and IP phones
Thank you... that's kind of what I was suspecting. >>> Nick Cutting <ncutt...@edgetg.com> 8/18/2017 5:02 PM >>> So it is a combination of SPAN and RSPAN because of the local RSPAN as a source on "same switch destination back to diff session not see traffic issue" I have seen this on 3560 / 3850 / 6500. SWITCH 1 monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination Gi1/0/48 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/XX (can't use same port) SWITCH 2 monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880 This will work - but you need two destination ports. The only way I can think of to do it will one destination port and RSPAN is use a third switch as the destination. -Original Message- From: cisco-nsp [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Nick Cutting Sent: Friday, August 18, 2017 4:05 PM To: Steven Pfister <spfis...@dps.k12.oh.us>; cisco-nsp@puck.nether.net Subject: Re: [c-nsp] RSPAN and IP phones It has been a while since I have done this - but I have battled this exact setup a few times. I seem to remember that the local switch needs to have a physical span destination, i.e not the rspan vlan - needs to be a port, and only the remote switch needs the rspan destination. The second monitor session picks up the RSPAN as the source and then the port as the destination, but on the first switch. Traffic that is captured on the source and dumped into the rspan vlan, cannot be seen on the SAME switch for some reason was the limitation I think. I hope that made some kind of sense. -Original Message- From: cisco-nsp [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Steven Pfister Sent: Friday, August 18, 2017 2:56 PM To: cisco-nsp@puck.nether.net Subject: [c-nsp] RSPAN and IP phones I've got a setup at one of our sites where I've got several IP phones and a SPAN session copying traffic to them to a port on the same switch which is a call recorder. This works fine. We're recently added a second switch to this location which also serves IP phones. I'm trying to change from SPAN to RSPAN. For some reason, I either get no calls recorded, or the calls are nothing but silence. I've got vlan 880 configured as a remote-span vlan, and I'm just doing: monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination remote vlan 880 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/48 on the first switch, and monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880 vlan 880 is configured as a remote span vlan on both switches and the vlan is allowed on the trunks going to the switches. Please try our new DPS mobile app! Available in the Google Playstore (android) or Apple iTunes store. Android: https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonps=en Apple: https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8 ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ Please try our new DPS mobile app! Available in the Google Playstore (android) or Apple iTunes store. Android: https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonpshl=en Apple: https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8 ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: [c-nsp] RSPAN and IP phones
So it is a combination of SPAN and RSPAN because of the local RSPAN as a source on "same switch destination back to diff session not see traffic issue" I have seen this on 3560 / 3850 / 6500. SWITCH 1 monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination Gi1/0/48 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/XX (can't use same port) SWITCH 2 monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880 This will work - but you need two destination ports. The only way I can think of to do it will one destination port and RSPAN is use a third switch as the destination. -Original Message- From: cisco-nsp [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Nick Cutting Sent: Friday, August 18, 2017 4:05 PM To: Steven Pfister <spfis...@dps.k12.oh.us>; cisco-nsp@puck.nether.net Subject: Re: [c-nsp] RSPAN and IP phones It has been a while since I have done this - but I have battled this exact setup a few times. I seem to remember that the local switch needs to have a physical span destination, i.e not the rspan vlan - needs to be a port, and only the remote switch needs the rspan destination. The second monitor session picks up the RSPAN as the source and then the port as the destination, but on the first switch. Traffic that is captured on the source and dumped into the rspan vlan, cannot be seen on the SAME switch for some reason was the limitation I think. I hope that made some kind of sense. -Original Message- From: cisco-nsp [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Steven Pfister Sent: Friday, August 18, 2017 2:56 PM To: cisco-nsp@puck.nether.net Subject: [c-nsp] RSPAN and IP phones I've got a setup at one of our sites where I've got several IP phones and a SPAN session copying traffic to them to a port on the same switch which is a call recorder. This works fine. We're recently added a second switch to this location which also serves IP phones. I'm trying to change from SPAN to RSPAN. For some reason, I either get no calls recorded, or the calls are nothing but silence. I've got vlan 880 configured as a remote-span vlan, and I'm just doing: monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination remote vlan 880 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/48 on the first switch, and monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880 vlan 880 is configured as a remote span vlan on both switches and the vlan is allowed on the trunks going to the switches. Please try our new DPS mobile app! Available in the Google Playstore (android) or Apple iTunes store. Android: https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonpshl=en Apple: https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8 ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: [c-nsp] RSPAN and IP phones
It has been a while since I have done this - but I have battled this exact setup a few times. I seem to remember that the local switch needs to have a physical span destination, i.e not the rspan vlan - needs to be a port, and only the remote switch needs the rspan destination. The second monitor session picks up the RSPAN as the source and then the port as the destination, but on the first switch. Traffic that is captured on the source and dumped into the rspan vlan, cannot be seen on the SAME switch for some reason was the limitation I think. I hope that made some kind of sense. -Original Message- From: cisco-nsp [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Steven Pfister Sent: Friday, August 18, 2017 2:56 PM To: cisco-nsp@puck.nether.net Subject: [c-nsp] RSPAN and IP phones I've got a setup at one of our sites where I've got several IP phones and a SPAN session copying traffic to them to a port on the same switch which is a call recorder. This works fine. We're recently added a second switch to this location which also serves IP phones. I'm trying to change from SPAN to RSPAN. For some reason, I either get no calls recorded, or the calls are nothing but silence. I've got vlan 880 configured as a remote-span vlan, and I'm just doing: monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination remote vlan 880 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/48 on the first switch, and monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880 vlan 880 is configured as a remote span vlan on both switches and the vlan is allowed on the trunks going to the switches. Please try our new DPS mobile app! Available in the Google Playstore (android) or Apple iTunes store. Android: https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonpshl=en Apple: https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8 ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
[c-nsp] RSPAN and IP phones
I've got a setup at one of our sites where I've got several IP phones and a SPAN session copying traffic to them to a port on the same switch which is a call recorder. This works fine. We're recently added a second switch to this location which also serves IP phones. I'm trying to change from SPAN to RSPAN. For some reason, I either get no calls recorded, or the calls are nothing but silence. I've got vlan 880 configured as a remote-span vlan, and I'm just doing: monitor session 1 source interface Gi1/0/1 - 24 monitor session 1 destination remote vlan 880 monitor session 2 source remote vlan 880 monitor session 2 destination interface Gi1/0/48 on the first switch, and monitor session 1 source interface Gi1/0/1 - 6 monitor session 1 destination remote vlan 880 vlan 880 is configured as a remote span vlan on both switches and the vlan is allowed on the trunks going to the switches. Please try our new DPS mobile app! Available in the Google Playstore (android) or Apple iTunes store. Android: https://play.google.com/store/apps/details?id=com.relianceco.cma.daytonpshl=en Apple: https://itunes.apple.com/us/app/dayton-public-schools/id1143389548?mt=8 ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
