Cisco 7600 Series Cisco IOS Software Configuration Guide, 12.2SX
Configuring Local SPAN, Remote SPAN (RSPAN), and Encapsulated RSPAN (ERSPAN)
Downloads: This chapterpdf (PDF - 438.0KB) The complete bookPDF (PDF - 15.41MB) | Feedback

Configuring Local SPAN, RSPAN, and ERSPAN

Table Of Contents

Configuring Local SPAN, RSPAN, and ERSPAN

Understanding How Local SPAN, RSPAN, and ERSPAN Work

Local SPAN, RSPAN, and ERSPAN Overview

Local SPAN Overview

RSPAN Overview

ERSPAN Overview

Monitored Traffic

Local SPAN, RSPAN, and ERSPAN Sources

Source Ports

Source VLANs

Local SPAN, RSPAN, and ERSPAN Destination Ports

Local SPAN, RSPAN, and ERSPAN Configuration Guidelines and Restrictions

General Guidelines and Restrictions

Feature Incompatiblities

Local SPAN, RSPAN, and ERSPAN Session Limits

PFC3

PFC2

Local SPAN, RSPAN, and ERSPAN Guidelines and Restrictions

VSPAN Guidelines and Restrictions

RSPAN Guidelines and Restrictions

ERSPAN Guidelines and Restrictions

Configuring Local SPAN, RSPAN, and ERSPAN

Configuring Destination Port Permit Lists (Optional)

Configuring Local SPAN

Configuring RSPAN

Configuring RSPAN VLANs

Configuring RSPAN Source Sessions

Configuring RSPAN Destination Sessions

Configuring ERSPAN

Configuring ERSPAN Source Sessions

Configuring ERSPAN Destination Sessions

Configuring Source VLAN Filtering for Local SPAN and RSPAN

Configuring a Destination Port as an Unconditional Trunk

Configuring Destination Trunk Port VLAN Filtering

Verifying the Configuration

Configuration Examples


Configuring Local SPAN, RSPAN, and ERSPAN


This chapter describes how to configure local Switched Port Analyzer (SPAN), remote SPAN (RSPAN), and Encapsulated RSPAN (ERSPAN) on the Cisco 7600 series routers. With a PFC3, Release 12.2(18)SXE and later releases support ERSPAN (see the "ERSPAN Guidelines and Restrictions" section).


NoteFor complete syntax and usage information for the commands used in this chapter, refer to the Cisco IOS Master Command List, Release 12.2SX at this URL:

http://www.cisco.com/en/US/docs/ios/mcl/122sxmcl/12_2sx_mcl_book.html

OSM WAN ports and FlexWAN ports do not support SPAN, RSPAN or ERSPAN.

PFC2 does not support ERSPAN.


This chapter consists of these sections:

Understanding How Local SPAN, RSPAN, and ERSPAN Work

Local SPAN, RSPAN, and ERSPAN Configuration Guidelines and Restrictions

Configuring Local SPAN, RSPAN, and ERSPAN


Tip For additional information (including configuration examples and troubleshooting information), see the documents listed on this page:

http://www.cisco.com/en/US/products/hw/routers/ps368/tsd_products_support_series_home.html


Understanding How Local SPAN, RSPAN, and ERSPAN Work

These sections describe how local SPAN, RSPAN, and ERSPAN work:

Local SPAN, RSPAN, and ERSPAN Overview

Local SPAN, RSPAN, and ERSPAN Sources

Local SPAN, RSPAN, and ERSPAN Destination Ports

Local SPAN, RSPAN, and ERSPAN Overview

Local SPAN, RSPAN, and ERSPAN sessions allow you to monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports. With Release 12.2(18)SXD and later releases, you can configure per-VLAN filtering on destination trunk ports.

Local SPAN, RSPAN, and ERSPAN all send traffic to a network analyzer such as a SwitchProbe device or other Remote Monitoring (RMON) probe. SPAN does not affect the switching of traffic on source ports or VLANs. SPAN sends a copy of the packets received or transmitted by the source ports and VLANs to the destination port. You must dedicate the destination port for SPAN use.

These sections provide an overview of local SPAN, RSPAN, and ERSPAN:

Local SPAN Overview

RSPAN Overview

ERSPAN Overview

Monitored Traffic

Local SPAN Overview

A local SPAN session is an association of source ports and source VLANs with one or more destination ports. You configure a local SPAN session on a single router. Local SPAN does not have separate source and destination sessions.

Local SPAN sessions do not copy locally sourced RSPAN VLAN traffic from source trunk ports that carry RSPAN VLANs. Local SPAN sessions do not copy locally sourced RSPAN GRE-encapsulated traffic from source ports.

Each local SPAN session can have either ports or VLANs as sources, but not both.

Local SPAN copies traffic from one or more source ports in any VLAN or from one or more VLANs to a destination port for analysis (see Figure 52-1). For example, as shown in Figure 52-1, all traffic on Ethernet port 5 (the source port) is copied to Ethernet port 10. A network analyzer on Ethernet port 10 receives all traffic from Ethernet port 5 without being physically attached to Ethernet port 5.

Figure 52-1 Example SPAN Configuration

RSPAN Overview

RSPAN supports source ports, source VLANs, and destination ports on different routers, which provides remote monitoring of multiple routers across your network (see Figure 52-2).

RSPAN consists of an RSPAN source session, an RSPAN VLAN, and an RSPAN destination session. You separately configure RSPAN source sessions and destination sessions on different routers. To configure an RSPAN source session on one router, you associate a set of source ports or VLANs with an RSPAN VLAN. To configure an RSPAN destination session on another router, you associate the destination ports with the RSPAN VLAN.

The traffic for each RSPAN session is carried as Layer 2 nonroutable traffic over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating routers. All participating routers must be trunk-connected at Layer 2.

RSPAN source sessions do not copy locally sourced RSPAN VLAN traffic from source trunk ports that carry RSPAN VLANs. RSPAN source sessions do not copy locally sourced RSPAN GRE-encapsulated traffic from source ports.

Each RSPAN source session can have either ports or VLANs as sources, but not both.

The RSPAN source session copies traffic from the source ports or source VLANs and switches the traffic over the RSPAN VLAN to the RSPAN destination session. The RSPAN destination session switches the traffic to the destination ports.

Figure 52-2 RSPAN Configuration

ERSPAN Overview

ERSPAN supports source ports, source VLANs, and destination ports on different routers, which provides remote monitoring of multiple routers across your network (see Figure 52-3).

ERSPAN consists of an ERSPAN source session, routable ERSPAN GRE-encapsulated traffic, and an ERSPAN destination session. You separately configure ERSPAN source sessions and destination sessions on different routers.

To configure an ERSPAN source session on one router, you associate a set of source ports or VLANs with a destination IP address, ERSPAN ID number, and optionally with a VRF name. To configure an ERSPAN destination session on another router, you associate the destination ports with the source IP address, ERSPAN ID number, and optionally with a VRF name.

ERSPAN source sessions do not copy locally sourced RSPAN VLAN traffic from source trunk ports that carry RSPAN VLANs. ERSPAN source sessions do not copy locally sourced ERSPAN GRE-encapsulated traffic from source ports.

Each ERSPAN source session can have either ports or VLANs as sources, but not both.

The ERSPAN source session copies traffic from the source ports or source VLANs and forwards the traffic using routable GRE-encapsulated packets to the ERSPAN destination session. The ERSPAN destination session switches the traffic to the destination ports.

Figure 52-3 ERSPAN Configuration

Monitored Traffic

These sections describe the traffic that local SPAN, RSPAN, and ERSPAN can monitor:

Monitored Traffic Direction

Monitored Traffic

Duplicate Traffic

Monitored Traffic Direction

You can configure local SPAN sessions, RSPAN source sessions, and ERSPAN source sessions to monitor ingress traffic (called ingress SPAN), or to monitor egress traffic (called egress SPAN), or to monitor traffic flowing in both directions.

Ingress SPAN copies traffic received by the source ports and VLANs for analysis at the destination port. Egress SPAN copies traffic transmitted from the source ports and VLANs. When you enter the both keyword, SPAN copies the traffic received and transmitted by the source ports and VLANs to the destination port.

Monitored Traffic

By default, local SPAN and ERSPAN monitor all traffic, including multicast and bridge protocol data unit (BPDU) frames. RSPAN does not support BPDU monitoring.

Duplicate Traffic

In some configurations, SPAN sends multiple copies of the same source traffic to the destination port. For example, in a configuration with a bidirectional SPAN session (both ingress and egress) for two SPAN sources, called s1 and s2, to a SPAN destination port, called d1, if a packet enters the router through s1 and is sent for egress from the switch to s2, ingress SPAN at s1 sends a copy of the packet to SPAN destination d1 and egress SPAN at s2 sends a copy of the packet to SPAN destination d1. If the packet was Layer 2 switched from s1 to s2, both SPAN packets would be the same. If the packet was Layer 3 switched from s1 to s2, the Layer 3 rewrite would alter the source and destination Layer 2 addresses, in which case the SPAN packets would be different.

Local SPAN, RSPAN, and ERSPAN Sources

These sections describe local SPAN, RSPAN, and ERSPAN sources:

Source Ports

Source VLANs

Source Ports

A source port is a port monitored for traffic analysis. You can configure both switched and routed ports as SPAN source ports. SPAN can monitor one or more source ports in a single SPAN session. You can configure source ports in any VLAN. Trunk ports can be configured as source ports and mixed with nontrunk source ports. SPAN does not copy the encapsulation from a source trunk port.

Source VLANs

A source VLAN is a VLAN monitored for traffic analysis. VLAN-based SPAN (VSPAN) uses a VLAN as the SPAN source. All the ports in the source VLANs become source ports.

Local SPAN, RSPAN, and ERSPAN Destination Ports

A destination port is a Layer 2 or Layer 3 LAN port to which local SPAN, RSPAN, or ERSPAN sends traffic for analysis.

When you configure a port as a destination port, it can no longer receive any traffic. When you configure a port as a destination port, the port is dedicated for use only by the SPAN feature. A SPAN destination port does not forward any traffic except that required for the SPAN session.

You can configure trunk ports as destination ports, which allows destination trunk ports to transmit encapsulated traffic. With Release 12.2(18)SXD and later releases, for local SPAN, you can configure per-VLAN filtering on destination trunk ports using allowed VLAN lists (see the "Configuring Destination Trunk Port VLAN Filtering" section).

Local SPAN, RSPAN, and ERSPAN Configuration Guidelines and Restrictions

These sections describe local SPAN, RSPAN, and ERSPAN configuration guidelines and restrictions:

General Guidelines and Restrictions

Feature Incompatiblities

Local SPAN, RSPAN, and ERSPAN Session Limits

Local SPAN, RSPAN, and ERSPAN Guidelines and Restrictions

VSPAN Guidelines and Restrictions

RSPAN Guidelines and Restrictions

ERSPAN Guidelines and Restrictions


Note Release 12.2(18)SXE and later releases support ERSPAN.


General Guidelines and Restrictions

Use SPAN for troubleshooting. Except in carefully planned topologies, SPAN consumes too many switch and network resources to enable permanently.

Exercise all possible care when enabling and configuring SPAN. The traffic copied by SPAN can impose a significant load on the switch and the network.

To minimize the load, configure SPAN to copy only the specific traffic that you want to analyze. Select sources that carry as little unwanted traffic as possible. For example, a port as a SPAN source might carry less unwanted traffic than a VLAN.


Note To monitor traffic that can be matched with an ACL, consider using VACL capture.


Before enabling SPAN, carefully evaluate the SPAN source traffic rates, and consider the performance implications and possible oversubscription points, which include these:

SPAN destination

Fabric channel

Rewrite/replication engine

Forwarding engine (PFC/DFC)

To avoid disrupting traffic, do not oversubscribe any of these points in your SPAN topology. Some oversubscription and performance considerations are:

SPAN doubles traffic internally

SPAN adds to the traffic being processed by the switch fabric

SPAN doubles forwarding engine load

The supervisor engine handles the entire load imposed by egress SPAN (also called transmit SPAN).


Note Egress SPAN should only be enabled for short periods of time during active troubleshooting


The ingress modules handle the load imposed by ingress SPAN sources (also called receive SPAN) on each module. Ingress SPAN adds to rewrite/replication engine load.

Feature Incompatiblities

These feature incompatibilities exist with local SPAN, RSPAN, and ERSPAN:

Egress SPAN is not supported in egress multicast mode. (CSCsa95965)

With a PFC3, EoMPLS ports cannot be SPAN sources. (CSCed51245)

A port-channel interface (an EtherChannel) can be a SPAN source, but you cannot configure active member ports of an EtherChannel as SPAN source ports. Inactive member ports of an EtherChannel can be configured as SPAN sources but they are put into the suspended state and carry no traffic.

With releases earlier than Release 12.2(33)SXH, a port-channel interface (an EtherChannel) cannot be a SPAN destination.

You cannot configure active member ports of an EtherChannel as SPAN destination ports. Inactive member ports of an EtherChannel can be configured as SPAN destination ports but they are put into the suspended state and carry no traffic.

Because SPAN destination ports drop ingress traffic, these features are incompatible with SPAN destination ports:

Private VLANs

IEEE 802.1X port-based authentication

Port security

Spanning tree protocol (STP) and related features (PortFast, PortFast BPDU Filtering, BPDU Guard, UplinkFast, BackboneFast, EtherChannel Guard, Root Guard, Loop Guard)

VLAN trunk protocol (VTP)

Dynamic trunking protocol (DTP)

IEEE 802.1Q tunneling


Note SPAN destination ports can participate in IEEE 802.3Z Flow Control.



Note IP multicast switching using egress packet replication is not compatible with SPAN. In some cases, egress replication can result in multicast packets not being sent to the SPAN destination port. If you are using SPAN and your switching modules are capable of egress replication, enter the mls ip multicast replication-mode ingress command to force ingress replication.


Local SPAN, RSPAN, and ERSPAN Session Limits

These sections describe the local SPAN, RSPAN, and ERSPAN session limits:

PFC3

PFC2

PFC3

These are the PFC3 local SPAN, RSPAN, and ERSPAN session limits:

Total Sessions
Local SPAN, RSPAN Source, or ERSPAN Source Sessions
RSPAN Destination Sessions
ERSPAN Destination Sessions

66

2 (ingress or egress or both)

64

23


These are the PFC3 local SPAN, RSPAN, and ERSPAN source and destination limits:

 
In Each Local SPAN Session
In Each RSPAN Source Session
In Each ERSPAN Source Session
In Each RSPAN Destination Session
In Each ERSPAN Destination Session

Egress or "both" sources

With releases earlier than Release 12.2(18)SXE

1

1

1

Release 12.2(18)SXE and later releases

128

128

128

Ingress sources

With releases earlier than Release 12.2(18)SXD

64

64

64

Release 12.2(18)SXD and later releases

128

128

128

RSPAN and ERSPAN destination session sources

1 RSPAN VLAN

1 IP address

Destinations per session

64

1 RSPAN VLAN

1 IP address

64

64


PFC2


NotePFC2 does not support RSPAN if you configure an egress SPAN source for a local SPAN session.

PFC2 does not support egress SPAN sources for local SPAN if you configure RSPAN.


These are the PFC2 local SPAN and RSPAN session limits:

Total Sessions
Local SPAN Sessions
RSPAN Source Sessions
RSPAN Destination Sessions

66

2 (ingress or egress or both)

0

64

1 ingress

1 (ingress or egress or both)

64

1 or 2 egress

0

64


These are the PFC2 local SPAN and RSPAN source and destination limits:

 
In Each Local SPAN Session
In Each RSPAN Source Session
In Each RSPAN Destination Session

Egress or "both" sources

With releases earlier than Release 12.2(18)SXF2

1 (0 with a remote SPAN source session configured)

1 (0 with a local SPAN egress source session configured)

Release 12.2(18)SXF2 and later releases

128

128

Ingress sources

With releases earlier than Release 12.2(18)SXD

64

64

Release 12.2(18)SXD and later releases

128

128

RSPAN destination session source

1 RSPAN VLAN

Destinations per session

64

1 RSPAN VLAN

64


Local SPAN, RSPAN, and ERSPAN Guidelines and Restrictions

These guidelines and restrictions apply to local SPAN, RSPAN, and ERSPAN:

A SPAN destination port that is copying traffic from a single egress SPAN source port sends only egress traffic to the network analyzer. However, in Release 12.2(18)SXE and later releases, if you configure more than one egress SPAN source port, the traffic that is sent to the network analyzer also includes these types of ingress traffic that were received from the egress SPAN source ports:

Any unicast traffic that is flooded on the VLAN

Broadcast and multicast traffic

This situation occurs because an egress SPAN source port receives these types of traffic from the VLAN but then recognizes itself as the source of the traffic and drops it instead of sending it back to the source from which it was received. Before the traffic is dropped, SPAN copies the traffic and sends it to the SPAN destination port. (CSCds22021)

Entering additional monitor session commands does not clear previously configured SPAN parameters. You must enter the no monitor session command to clear configured SPAN parameters.

Connect a network analyzer to the SPAN destination ports.

All the SPAN destination ports receive all of the traffic from all the SPAN sources.


Note With Release 12.2(18)SXD and later releases, you can configure destination trunk port VLAN filtering using allowed VLAN lists (see the "Configuring Destination Trunk Port VLAN Filtering" section).

With Release 12.2(18)SXE and later releases, for local SPAN and RSPAN, you can configure Source VLAN Filtering (see the "Configuring Source VLAN Filtering for Local SPAN and RSPAN" section).


You can configure both Layer 2 LAN ports (LAN ports configured with the switchport command) and Layer 3 LAN ports (LAN ports not configured with the switchport command) as sources or destinations.

You cannot mix individual source ports and source VLANs within a single session.

If you specify multiple ingress source ports, the ports can belong to different VLANs.

You cannot mix source VLANs and filter VLANs within a session. You can have source VLANs or filter VLANs, but not both at the same time.

When enabled, local SPAN, RSPAN, and ERSPAN use any previously entered configuration.

When you specify sources and do not specify a traffic direction (ingress, egress, or both), "both" is used by default.

SPAN copies Layer 2 Ethernet frames, but SPAN does not copy source trunk port ISL or 802.1Q tags. You can configure destination ports as trunks to send locally tagged traffic to the traffic analyzer.


Note A destination port configured as a trunk tags traffic from a Layer 3 LAN source port with the internal VLAN used by the Layer 3 LAN port.


Local SPAN sessions, RSPAN source sessions, and ERSPAN source sessions do not copy locally sourced RSPAN VLAN traffic from source trunk ports that carry RSPAN VLANs.

Local SPAN sessions, RSPAN source sessions, and ERSPAN source sessions do not copy locally sourced ERSPAN GRE-encapsulated traffic from source ports.

A port specified as a destination port in one SPAN session cannot be a destination port for another SPAN session.

A port configured as a destination port cannot be configured as a source port.

Destination ports never participate in any spanning tree instance. Local SPAN includes BPDUs in the monitored traffic, so any BPDUs seen on the destination port are from the source port. RSPAN does not support BPDU monitoring.

All packets sent through the router for transmission from a port configured as an egress source are copied to the destination port, including packets that do not exit the router through the port because STP has put the port into the blocking state, or on a trunk port because STP has put the VLAN into the blocking state on the trunk port.

VSPAN Guidelines and Restrictions


Note Local SPAN, RSPAN, and ERSPAN all support VSPAN.


These are VSPAN guidelines and restrictions:

For VSPAN sessions with both ingress and egress configured, two packets are forwarded from the destination port if the packets get switched on the same VLAN (one as ingress traffic from the ingress port and one as egress traffic from the egress port).

VSPAN only monitors traffic that leaves or enters Layer 2 ports in the VLAN.

If you configure a VLAN as an ingress source and traffic gets routed into the monitored VLAN, the routed traffic is not monitored because it never appears as ingress traffic entering a Layer 2 port in the VLAN.

If you configure a VLAN as an egress source and traffic gets routed out of the monitored VLAN, the routed traffic is not monitored because it never appears as egress traffic leaving a Layer 2 port in the VLAN.

RSPAN Guidelines and Restrictions

These are RSPAN guidelines and restrictions:

Supervisor Engine 2 does not support RSPAN if you configure an egress SPAN source for a local SPAN session.

Supervisor Engine 2 does not support egress SPAN sources for local SPAN if you configure RSPAN.

All participating routers must be trunk-connected at Layer 2.

Any network device that supports RSPAN VLANs can be an RSPAN intermediate device.

Networks impose no limit on the number of RSPAN VLANs that the networks carry.

Intermediate network devices might impose limits on the number of RSPAN VLANs that they can support.

You must configure the RSPAN VLANs in all source, intermediate, and destination network devices. If enabled, the VLAN Trunking Protocol (VTP) can propagate configuration of VLANs numbered 1 through 1024 as RSPAN VLANs. You must manually configure VLANs numbered higher than 1024 as RSPAN VLANs on all source, intermediate, and destination network devices.

If you enable VTP and VTP pruning, RSPAN traffic is pruned in the trunks to prevent the unwanted flooding of RSPAN traffic across the network.

RSPAN VLANs can be used only for RSPAN traffic.

Do not configure a VLAN used to carry management traffic as an RSPAN VLAN.

Do not assign access ports to RSPAN VLANs. RSPAN puts access ports in an RSPAN VLAN into the suspended state.

Do not configure any ports in an RSPAN VLAN except trunk ports selected to carry RSPAN traffic.

MAC address learning is disabled in the RSPAN VLAN.

You can use output access control lists (ACLs) on the RSPAN VLAN in the RSPAN source router to filter the traffic sent to an RSPAN destination.

RSPAN does not support BPDU monitoring.

Do not configure RSPAN VLANs as sources in VSPAN sessions.

You can configure any VLAN as an RSPAN VLAN as long as all participating network devices support configuration of RSPAN VLANs and you use the same RSPAN VLAN for each RSPAN session in all participating network devices.

ERSPAN Guidelines and Restrictions

These are ERSPAN guidelines and restrictions:

Release 12.2(18)SXE and later releases support ERSPAN.

Release 12.2(18)SXF and later releases support ERSPAN when the router is operating in any switching mode. (CSCec70695)

Release 12.2(18)SXE and rebuilds support ERSPAN only when the router is operating in the compact switching mode: all modules must be fabric-enabled.

The following supervisor engines support ERSPAN:

Supervisor engines manufactured with PFC3B and PFC3BXL support ERSPAN.

A WS-SUP720 (a Supervisor Engine 720 manufactured with a PFC3A) can only support ERSPAN if it has hardware version 3.2 or higher. Enter the show module version | include WS-SUP720-BASE command to display the hardware version. For example:

Router# show module version | include WS-SUP720-BASE 
 7    2  WS-SUP720-BASE     SAD075301SZ Hw :3.2

To confirm that your supervisor engine supports ERSPAN, enter the show asic-version slot slot_number | include ASIC|HYPERION command for the supervisor engine. For example:

Router# show asic-version slot 1 | include ASIC|HYPERION 
Module in slot 1 has 2 type(s) of ASICs
        ASIC Name      Count      Version
         HYPERION          1      (6.0)

Hyperion version 2.0 and higher supports ERSPAN.

Supervisor engine 2 does not support ERSPAN.

For ERSPAN packets, the "protocol type" field value in the GRE header is 0x88BE.

The payload of a Layer 3 ERSPAN packet is a copied Layer 2 Ethernet frame, excluding any ISL or 802.1Q tags.

ERSPAN adds a 50-byte header to each copied Layer 2 Ethernet frame and replaces the 4-byte cyclic redundancy check (CRC) trailer.

ERSPAN supports jumbo frames that contain Layer 3 packets of up to 9,202 bytes. If the length of the copied Layer 2 Ethernet frame is greater than 9,170 (9,152-byte Layer 3 packet), ERSPAN truncates the copied Layer 2 Ethernet frame to create a 9,202-byte ERSPAN Layer 3 packet.

Regardless of any configured MTU size, ERSPAN creates Layer 3 packets that can be as long as 9,202 bytes. ERSPAN traffic might be dropped by any interface in the network that enforces an MTU size smaller than 9,202 bytes.

With the default MTU size (1,500 bytes), if the length of the copied Layer 2 Ethernet frame is greater than 1,468 bytes (1,450-byte Layer 3 packet), the ERSPAN traffic is dropped by any interface in the network that enforces the 1,500-byte MTU size.


Note The mtu interface command and the system jumbomtu command (see the "Configuring Jumbo Frame Support" section on page 9-10) set the maximum Layer 3 packet size (default is 1,500 bytes, maximum is 9,216 bytes).


All participating routers must be connected at Layer 3 and the network path must support the size of the ERSPAN traffic.

ERSPAN does not support packet fragmentation. The "do not fragment" bit is set in the IP header of ERSPAN packets. ERSPAN destination sessions cannot reassemble fragmented ERSPAN packets.

ERSPAN traffic is subject to the traffic load conditions of the network. You can set the ERSPAN packet IP precedence or DSCP value to prioritize ERSPAN traffic for QoS.

The only supported destination for ERSPAN traffic is an ERSPAN destination session on a PFC3.

All ERSPAN source sessions on a router must use the same origin IP address, configured with the origin ip address command (see the "Configuring ERSPAN Source Sessions" section).

All ERSPAN destination sessions on a switch must use the same IP address on the same destination interface. You enter the destination interface IP address with the ip address command (see the "Configuring ERSPAN Destination Sessions" section).

The ERSPAN source session's destination IP address, which must be configured on an interface on the destination router, is the source of traffic that an ERSPAN destination session sends to the destination ports. You configure the same address in both the source and destination sessions with the ip address command.

The ERSPAN ID differentiates the ERSPAN traffic arriving at the same destination IP address from various different ERSPAN source sessions.

Configuring Local SPAN, RSPAN, and ERSPAN

These sections describe how to configure local SPAN, RSPAN, and ERSPAN:

Configuring Destination Port Permit Lists (Optional)

Configuring Local SPAN

Configuring RSPAN

Configuring ERSPAN

Configuring Source VLAN Filtering for Local SPAN and RSPAN

Configuring a Destination Port as an Unconditional Trunk

Configuring Destination Trunk Port VLAN Filtering

Verifying the Configuration

Configuration Examples

Configuring Destination Port Permit Lists (Optional)

To prevent accidental configuration of ports as destinations, you can create a permit list of the ports that are valid for use as destinations. With a destination port permit list configured, you can only configure the ports in the permit list as destinations.

To configure a destination port permit list, perform this task:

 
Command
Purpose

Step 1 

Router# configure terminal

Enters global configuration mode.

Step 2 

Router(config)# monitor permit-list

Enables use of the destination port permit list.

Step 3 

Router(config)# no monitor permit-list

Disables use of the destination port permit list.

Step 4 

Router(config)# monitor permit-list destination interface type1 slot/port[-port] [type1 slot/port - port]

Configures a destination port permit list or adds to an existing destination port permit list.

Step 5 

Router(config)# no monitor permit-list destination interface type1 slot/port[-port] [type1 slot/port - port]

Deletes from or clears an existing destination port permit list.

Step 6 

Router(config)# do show monitor permit-list

Verifies the configuration.

1 type = ethernet, fastethernet, gigabitethernet, or tengigabitethernet

This example shows how to configure a destination port permit list that includes Gigabit Ethernet ports 5/1 through 5/4 and 6/1:

Router# configure terminal 
Router(config)# monitor permit-list 
Router(config)# monitor permit-list destination interface gigabitethernet 5/1-4, 
gigabitethernet 6/1 

This example shows how to verify the configuration:

Router(config)# do show monitor permit-list 
 SPAN Permit-list      :Admin Enabled
 Permit-list ports     :Gi5/1-4,Gi6/1

Configuring Local SPAN

Local SPAN does not use separate source and destination sessions. To configure a local SPAN session, configure local SPAN sources and destinations with the same session number. To configure a local SPAN session, perform this task:

 
Command
Purpose

Step 1 

Router# configure terminal

Enters global configuration mode.

Step 2 

Router(config)# monitor session local_span_session_number source {{single_interface | interface_list | interface_range | mixed_interface_list | single_vlan | vlan_list | vlan_range | mixed_vlan_list} [rx | tx | both]}}

Associates the local SPAN source session number with the source ports or VLANs and selects the traffic direction to be monitored.

Step 3 

Router(config)# monitor session local_span_session_number destination {single_interface | interface_list | interface_range | mixed_interface_list}

Associates the local SPAN session number and the destination ports.

Router(config)# no monitor session {session_number | all | local | range session_range[[,session_range],...]}

Clears the monitor configuration.

When configuring local SPAN sessions, note the following information:

local_span_session_number can range from 1 to 66.

single_interface is interface type slot/port; type is ethernet, fastethernet, gigabitethernet, or tengigabitethernet.

interface_list is single_interface , single_interface , single_interface ...


Note In lists, you must enter a space before and after the comma. In ranges, you must enter a space before and after the dash.


interface_range is interface type slot/first_port - last_port.

mixed_interface_list is, in any order, single_interface , interface_range , ...

single_vlan is the ID number of a single VLAN.

vlan_list is single_vlan , single_vlan , single_vlan ...

vlan_range is first_vlan_ID - last_vlan_ID.

mixed_vlan_list is, in any order, single_vlan , vlan_range , ...

To tag the monitored traffic as it leaves a destination port, you must configure the destination port to trunk unconditionally before you configure it as a destination (see the "Configuring a Destination Port as an Unconditional Trunk" section).

When clearing monitor sessions, note the following information:

The no monitor session number command entered with no other parameters clears session session_number.

session_range is first_session_number-last_session_number.


Note In the no monitor session range command, do not enter spaces before or after the dash. If you enter multiple ranges, do not enter spaces before or after the commas.


This example shows how to configure Fast Ethernet port 5/1 as a bidirectional source for session 1:

Router(config)# monitor session 1 source interface fastethernet 5/1 

This example shows how to configure Fast Ethernet port 5/48 as the destination for SPAN session 1:

Router(config)# monitor session 1 destination interface fastethernet 5/48 

For additional examples, see the "Configuration Examples" section.

Configuring RSPAN

RSPAN uses a source session on one router and a destination session on a different router. These sections describe how to configure RSPAN sessions:

Configuring RSPAN VLANs

Configuring RSPAN Source Sessions

Configuring RSPAN Destination Sessions

Configuring RSPAN VLANs

To configure a VLAN as an RSPAN VLAN, perform this task:

 
Command
Purpose

Step 1 

Router# configure terminal

Enters global configuration mode.

Step 2 

Router(config)# vlan vlan_ID{[-vlan_ID]|[,vlan_ID])

Creates or modifies an Ethernet VLAN, a range of Ethernet VLANs, or several Ethernet VLANs specified in a comma-separated list (do not enter space characters).

Step 3 

Router(config-vlan)# remote-span

Configures the VLAN as an RSPAN VLAN.

Router(config-vlan)# no remote-span

Clears the RSPAN VLAN configuration.

Step 4 

Router(config-vlan)# end

Updates the VLAN database and returns to privileged EXEC mode.

Configuring RSPAN Source Sessions

To configure an RSPAN source session, perform this task:

 
Command
Purpose

Step 1 

Router# configure terminal

Enters global configuration mode.

Step 2 

Router(config)# monitor session RSPAN_source_session_number source {{single_interface | interface_list | interface_range | mixed_interface_list | single_vlan | vlan_list | vlan_range | mixed_vlan_list} [rx | tx | both]}}

Associates the RSPAN source session number with the source ports or VLANs, and selects the traffic direction to be monitored.

Step 3 

Router(config)# monitor session RSPAN_source_session_number destination remote vlan rspan_vlan_ID

Associates the RSPAN source session number session number with the RSPAN VLAN.

Step 4 

Router(config)# no monitor session {session_number | all | range session_range[[,session_range],...] | remote}

Clears the monitor configuration.

When configuring monitor sessions, note the following information:

To configure RSPAN VLANs, see the "Configuring RSPAN VLANs" section.

RSPAN_source_span_session_number can range from 1 to 66.

single_interface is interface type slot/port; type is ethernet, fastethernet, gigabitethernet, or tengigabitethernet.

interface_list is single_interface , single_interface , single_interface ...


Note In lists, you must enter a space before and after the comma. In ranges, you must enter a space before and after the dash.


interface_range is interface type slot/first_port - last_port.

mixed_interface_list is, in any order, single_interface , interface_range , ...

single_vlan is the ID number of a single VLAN.

vlan_list is single_vlan , single_vlan , single_vlan ...

vlan_range is first_vlan_ID - last_vlan_ID.

mixed_vlan_list is, in any order, single_vlan , vlan_range , ...

When clearing monitor sessions, note the following information:

The no monitor session number command entered with no other parameters clears session session_number.

session_range is first_session_number-last_session_number.


Note In the no monitor session range command, do not enter spaces before or after the dash. If you enter multiple ranges, do not enter spaces before or after the commas.


This example shows how to configure Fast Ethernet port 5/2 as the source for session 2:

Router(config)# monitor session 2 source interface fastethernet 5/2 

This example shows how to configure RSPAN VLAN 200 as the destination for session 2:

Router(config)# monitor session 2 destination remote vlan 200 

For additional examples, see the "Configuration Examples" section.

Configuring RSPAN Destination Sessions


Note You can configure an RSPAN destination session on the RSPAN source session router to monitor RSPAN traffic locally.


To configure an RSPAN destination session, perform this task:

 
Command
Purpose

Step 1 

Router# configure terminal

Enters global configuration mode.

Step 2 

Router(config)# monitor session RSPAN_destination_session_number source remote vlan rspan_vlan_ID

Associates the RSPAN destination session number with the RSPAN VLAN.

Step 3 

Router(config)# monitor session RSPAN_destination_session_number destination {single_interface | interface_list | interface_range | mixed_interface_list}}

Associates the RSPAN destination session number with the destination ports.

Step 4 

Router(config)# no monitor session {session_number | all | range session_range[[,session_range],...] | remote}

Clears the monitor configuration.

When configuring monitor sessions, note the following information:

To tag the monitored traffic, you must configure the port to trunk unconditionally before you configure it as a destination (see the "Configuring a Destination Port as an Unconditional Trunk" section).

RSPAN_destination_span_session_number can range from 1 to 66.

single_interface is interface type slot/port; type is ethernet, fastethernet, gigabitethernet, or tengigabitethernet.

interface_list is single_interface , single_interface , single_interface ...


Note In lists, you must enter a space before and after the comma. In ranges, you must enter a space before and after the dash.


interface_range is interface type slot/first_port - last_port.

mixed_interface_list is, in any order, single_interface , interface_range , ...

When clearing monitor sessions, note the following information:

Enter the no monitor session number command with no other parameters to clear session session_number.

session_range is first_session_number-last_session_number.


Note In the no monitor session range command, do not enter spaces before or after the dash. If you enter multiple ranges, do not enter spaces before or after the commas.


This example shows how to configure RSPAN VLAN 200 as the source for session 3:

Router(config)# monitor session 3 source remote vlan 200 

This example shows how to configure Fast Ethernet port 5/47 as the destination for session 3:

Router(config)# monitor session 3 destination interface fastethernet 5/47 

For additional examples, see the "Configuration Examples" section.

Configuring ERSPAN

ERSPAN uses separate source and destination sessions. You configure the source and destination sessions on different routers. These sections describe how to configure ERSPAN sessions:

Configuring ERSPAN Source Sessions

Configuring ERSPAN Destination Sessions


Note With a PFC3, Release 12.2(18)SXE and later releases support ERSPAN (see the "ERSPAN Guidelines and Restrictions" section).


Configuring ERSPAN Source Sessions

To configure an ERSPAN source session, perform this task:

 
Command
Purpose

Step 1 

Router# configure terminal

Enters global configuration mode.

Step 2 

Router(config)# monitor session ERSPAN_source_session_number type erspan-source

Configures an ERSPAN source session number and enters ERSPAN source session configuration mode for the session.

Router(config)# no monitor session {session_number | all | range session_range[[,session_range],...]}

Clears the monitor configuration.

Step 3 

Router(config-mon-erspan-src)# description session_description

(Optional) Describes the ERSPAN source session.

Step 4 

Router(config-mon-erspan-src)# shutdown

(Default) Inactivates the ERSPAN source session.

Router(config-mon-erspan-src)# no shutdown

Activates the ERSPAN source session.

Step 5 

Router(config-mon-erspan-src)# source {{single_interface | interface_list | interface_range | mixed_interface_list | single_vlan | vlan_list | vlan_range | mixed_vlan_list} [rx | tx | both]}

Associates the ERSPAN source session number with the source ports or VLANs, and selects the traffic direction to be monitored.

Step 6 

Router(config-mon-erspan-src)# filter single_vlan | vlan_list | vlan_range | mixed_vlan_list

(Optional) Configures source VLAN filtering when the ERSPAN source is a trunk port.

Step 7 

Router(config-mon-erspan-src)# destination

Enters ERSPAN source session destination configuration mode.

Step 8 

Router(config-mon-erspan-src-dst)# ip address ip_address

Configures the ERSPAN flow destination IP address, which must also be configured on an interface on the destination router and be entered in the ERSPAN destination session configuration (see the "Configuring ERSPAN Destination Sessions" section, Step 7).

Step 9 

Router(config-mon-erspan-src-dst)# erspan-id ERSPAN_flow_id

Configures the ID number used by the source and destination sessions to identify the ERSPAN traffic, which must also be entered in the ERSPAN destination session configuration (see the "Configuring ERSPAN Destination Sessions" section, Step 8).

Step 10 

Router(config-mon-erspan-src-dst)# origin ip address ip_address [force]

Configures the IP address used as the source of the ERSPAN traffic.

Step 11 

Router(config-mon-erspan-src-dst)# ip ttl ttl_value

(Optional) Configures the IP time-to-live (TTL) value of the packets in the ERSPAN traffic.

Step 12 

Router(config-mon-erspan-src-dst)# ip prec ipp_value

(Optional) Configures the IP precedence value of the packets in the ERSPAN traffic.

Step 13 

Router(config-mon-erspan-src-dst)# ip dscp dscp_value

(Optional) Configures the IP DSCP value of the packets in the ERSPAN traffic.

Step 14 

Router(config-mon-erspan-src-dst)# vrf vrf_name

(Optional) Configures the VRF name to use instead of the global routing table.

Step 15 

Router(config-mon-erspan-src-dst)# end

Exits configuration mode.

When configuring monitor sessions, note the following information:

session_description can be up to 240 characters and cannot contain special characters or spaces.


Note You can enter 240 characters after the description command.


ERSPAN_source_span_session_number can range from 1 to 66.

single_interface is interface type slot/port; type is ethernet, fastethernet, gigabitethernet, or tengigabitethernet.

interface_list is single_interface , single_interface , single_interface ...


Note In lists, you must enter a space before and after the comma. In ranges, you must enter a space before and after the dash.


interface_range is interface type slot/first_port - last_port.

mixed_interface_list is, in any order, single_interface , interface_range , ...

single_vlan is the ID number of a single VLAN.

vlan_list is single_vlan , single_vlan , single_vlan ...

vlan_range is first_vlan_ID - last_vlan_ID.

mixed_vlan_list is, in any order, single_vlan , vlan_range , ...

ERSPAN_flow_id can range from 1 to 1023.

All ERSPAN source sessions on a switch must use the same source IP address. Enter the origin ip address ip_address force command to change the origin IP address configured in all ERSPAN source sessions on the router.

ttl_value can range from 1 to 255.

ipp_value can range from 0 to 7.

dscp_value can range from 0 to 63.

When clearing monitor sessions, note the following information:

The no monitor session number command entered with no other parameters clears session session_number.

session_range is first_session_number-last_session_number.


Note In the no monitor session range command, do not enter spaces before or after the dash. If you enter multiple ranges, do not enter spaces before or after the commas.


This example shows how to configure session 3 to monitor bidirectional traffic from Gigabit Ethernet port 4/1:

Router(config)# monitor session 3 type erspan-source 
Router(config-mon-erspan-src)# source interface gigabitethernet 4/1 
Router(config-mon-erspan-src)# destination 
Router(config-mon-erspan-src-dst)# ip address 10.1.1.1 
Router(config-mon-erspan-src-dst)# origin ip address 20.1.1.1 
Router(config-mon-erspan-src-dst)# erspan-id 101 

For additional examples, see the "Configuration Examples" section.

Configuring ERSPAN Destination Sessions


Note You cannot monitor ERSPAN traffic locally.


To configure an ERSPAN destination session, perform this task:

 
Command
Purpose

Step 1 

Router# configure terminal

Enters global configuration mode.

Step 2 

Router(config)# monitor session ERSPAN_destination_session_number type erspan-destination

Configures an ERSPAN destination session number and enters ERSPAN destination session configuration mode for the session.

Router(config)# no monitor session {session_number | all | range session_range[[,session_range],...]}

Clears the monitor configuration.

Step 3 

Router(config-mon-erspan-dst)# description session_description

(Optional) Describes the ERSPAN destination session.

Step 4 

Router(config-mon-erspan-dst)# shutdown

(Default) Inactivates the ERSPAN destination session.

Router(config-mon-erspan-dst)# no shutdown

Activates the ERSPAN destination session.

Step 5 

Router(config-mon-erspan-dst)# destination {single_interface | interface_list | interface_range | mixed_interface_list}}

Associates the ERSPAN destination session number with the destination ports.

Step 6 

Router(config-mon-erspan-dst)# source

Enters ERSPAN destination session source configuration mode.

Step 7 

Router(config-mon-erspan-dst-src)# ip address ip_address [force]

Configures the ERSPAN flow destination IP address. This must be an address on a local interface and match the address that you entered in the "Configuring ERSPAN Source Sessions" section, Step 8.

Step 8 

Router(config-mon-erspan-dst-src)# erspan-id ERSPAN_flow_id

Configures the ID number used by the destination and destination sessions to identify the ERSPAN traffic. This must match the ID that you entered in the "Configuring ERSPAN Source Sessions" section, Step 9.

Step 9 

Router(config-mon-erspan-dst-src)# vrf vrf_name

(Optional) Configures the VRF name used instead of the global routing table.

Step 10 

Router(config-mon-erspan-dst-src)# end

Exits configuration mode.

When configuring monitor sessions, note the following information:

ERSPAN_destination_span_session_number can range from 1 to 66.

single_interface is interface type slot/port; type is ethernet, fastethernet, gigabitethernet, or tengigabitethernet.

interface_list is single_interface , single_interface , single_interface ...


Note In lists, you must enter a space before and after the comma. In ranges, you must enter a space before and after the dash.


interface_range is interface type slot/first_port - last_port.

mixed_interface_list is, in any order, single_interface , interface_range , ...

All ERSPAN destination sessions on a switch must use the same IP address on the same destination interface. Enter the ip address ip_address force command to change the IP address configured in all ERSPAN destination sessions on the router.


Note You must also change all ERSPAN source session destination IP addresses (see the "Configuring ERSPAN Source Sessions" section, Step 8).


ERSPAN_flow_id can range from 1 to 1023.

When clearing monitor sessions, note the following information:

The no monitor session number command entered with no other parameters clears session session_number.

session_range is first_session_number-last_session_number.


Note In the no monitor session range command, do not enter spaces before or after the dash. If you enter multiple ranges, do not enter spaces before or after the commas.


This example shows how to configure an ERSPAN destination session to send ERSPAN ID 101 traffic arriving at IP address 10.1.1.1 to Gigabit Ethernet port 2/1:

Router(config)# monitor session 3 type erspan-destination 
Router(config-erspan-dst)# destination interface gigabitethernet 2/1 
Router(config-erspan-dst)# source 
Router(config-erspan-dst-src)# ip address 10.1.1.1 
Router(config-erspan-dst-src)# erspan-id 101 

For additional examples, see the "Configuration Examples" section.

Configuring Source VLAN Filtering for Local SPAN and RSPAN

Source VLAN filtering monitors specific VLANs when the source is a trunk port.


Note To configure source VLAN filtering for ERSPAN, see the "Configuring ERSPAN" section.


To configure source VLAN filtering when the local SPAN or RSPAN source is a trunk port, perform this task:

 
Command
Purpose

Step 1 

Router# configure terminal

Enters global configuration mode.

Step 2 

Router(config)# monitor session session_number filter single_vlan | vlan_list | vlan_range | mixed_vlan_list

Configures source VLAN filtering when the local SPAN or RSPAN source is a trunk port.

Router(config)# no monitor session session_number filter single_vlan | vlan_list | vlan_range | mixed_vlan_list

Clears source VLAN filtering.


When configuring source VLAN filtering, note the following information:

single_vlan is the ID number of a single VLAN.

vlan_list is single_vlan , single_vlan , single_vlan ...

vlan_range is first_vlan_ID - last_vlan_ID.

mixed_vlan_list is, in any order, single_vlan , vlan_range , ...

This example shows how to monitor VLANs 1 through 5 and VLAN 9 when the source is a trunk port:

Router(config)# monitor session 2 filter vlan 1 - 5 , 9

Configuring a Destination Port as an Unconditional Trunk

To tag the monitored traffic as it leaves a destination port, configure the destination port as a trunk.

To configure the destination port as a trunk, perform this task:

 
Command
Purpose

Step 1 

Router# configure terminal

Enters global configuration mode.

Step 2 

Router(config)# interface type1  slot/port

Selects the LAN port to configure.

Step 3 

Router(config-if)# switchport

Configures the LAN port for Layer 2 switching (required only if the LAN port is not already configured for Layer 2 switching).

Step 4 

Router(config-if)# switchport trunk encapsulation {isl | dot1q}

Configures the encapsulation, which configures the Layer 2 switching port as either an ISL or 802.1Q trunk.

Step 5 

Router(config-if)# switchport mode trunk

Configures the port to trunk unconditionally.

Step 6 

Router(config-if)# switchport nonegotiate

Configures the trunk not to use DTP.

1 type = ethernet, fastethernet, gigabitethernet, or tengigabitethernet

This example shows how to configure a port as an unconditional IEEE 802.1Q trunk:

Router(config)# interface fastethernet 5/12 
Router(config-if)# switchport 
Router(config-if)# switchport trunk encapsulation dot1q 
Router(config-if)# switchport mode trunk 
Router(config-if)# switchport nonegotiate 

Configuring Destination Trunk Port VLAN Filtering


Note In addition to filtering VLANs on a trunk, you can also apply the allowed VLAN list to access ports.


With Release 12.2(18)SXD and later releases, when a destination port is a trunk, you can use the list of VLANs allowed on the trunk to filter the traffic transmitted from the destination port. (CSCeb01318)

Destination trunk port VLAN filtering removes the restriction that all destination ports receive all the traffic from all the sources. Destination trunk port VLAN filtering allows you to select, on a per-VLAN basis, the traffic that is transmitted from each destination trunk port to the network analyzer.

To configure destination trunk port VLAN filtering on a destination trunk port, perform this task:

 
Command
Purpose

Step 1 

Router# configure terminal

Enters global configuration mode.

Step 2 

Router(config)# interface type1  slot/port

Selects the destination trunk port to configure.

Step 3 

Router(config-if)# switchport trunk allowed vlan {add | except | none | remove} vlan [,vlan[,vlan[,...]]

Configures the list of VLANs allowed on the trunk.

1 type = ethernet, fastethernet, gigabitethernet, or tengigabitethernet

When configuring the list of VLANs allowed on a destination trunk port, note the following information:

The vlan parameter is either a single VLAN number from 1 through 4094, or a range of VLANs described by two VLAN numbers, the lesser one first, separated by a dash. Do not enter any spaces between comma-separated vlan parameters or in dash-specified ranges.

All VLANs are allowed by default.

To remove all VLANs from the allowed list, enter the switchport trunk allowed vlan none command.

To add VLANs to the allowed list, enter the switchport trunk allowed vlan add command.

You can modify the allowed VLAN list without removing the SPAN configuration.

This example shows the configuration of a local SPAN session that has several VLANs as sources and several trunk ports as destinations, with destination trunk port VLAN filtering that filters the SPAN traffic so that each destination trunk port transmits the traffic from one VLAN:

interface GigabitEthernet1/1
description SPAN destination interface for VLAN 10
no ip address
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10
switchport mode trunk
switchport nonegotiate
!
interface GigabitEthernet1/2
description SPAN destination interface for VLAN 11
no ip address
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 11
switchport mode trunk
switchport nonegotiate
!
interface GigabitEthernet1/3
description SPAN destination interface for VLAN 12
no ip address
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 12
switchport mode trunk
switchport nonegotiate
!
interface GigabitEthernet1/4
description SPAN destination interface for VLAN 13
no ip address
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 13
switchport mode trunk
switchport nonegotiate
!
monitor session 1 source vlan 10 - 13
monitor session 1 destination interface Gi1/1 - 4

Verifying the Configuration

To verify the configuration, enter the show monitor session command.

This example shows how to verify the configuration of session 2:

Router# show monitor session 2
Session 2
------------
Type : Remote Source Session

Source Ports:
    RX Only:       Fa3/1
Dest RSPAN VLAN:   901
Router#

This example shows how to display the full details of session 2:

Router# show monitor session 2 detail 
Session 2
------------
Type : Remote Source Session

Source Ports:
    RX Only:       Fa1/1-3
    TX Only:       None
    Both:          None
Source VLANs:
    RX Only:       None
    TX Only:       None
    Both:          None
Source RSPAN VLAN: None
Destination Ports: None
Filter VLANs:      None
Dest RSPAN VLAN:   901

Configuration Examples

This example shows the configuration of RSPAN source session 2:

Router(config)# monitor session 2 source interface fastethernet1/1 - 3 rx 
Router(config)# monitor session 2 destination remote vlan 901 

This example shows how to clear the configuration for sessions 1 and 2:

Router(config)# no monitor session range 1-2 

This example shows the configuration of an RSPAN source session with multiple sources:

Router(config)# monitor session 2 source interface fastethernet 5/15 , 7/3 rx 
Router(config)# monitor session 2 source interface gigabitethernet 1/2 tx 
Router(config)# monitor session 2 source interface port-channel 102 
Router(config)# monitor session 2 source filter vlan 2 - 3 
Router(config)# monitor session 2 destination remote vlan 901 

This example shows how to remove sources for a session:

Router(config)# no monitor session 2 source interface fastethernet 5/15 , 7/3 

This example shows how to remove options for sources for a session:

Router(config)# no monitor session 2 source interface gigabitethernet 1/2 
Router(config)# no monitor session 2 source interface port-channel 102 tx 

This example shows how to remove VLAN filtering for a session:

Router(config)# no monitor session 2 filter vlan 3 

This example shows the configuration of RSPAN destination session 8:

Router(config)# monitor session 8 source remote vlan 901 
Router(config)# monitor session 8 destination interface fastethernet 1/2 , 2/3 

This example shows the configuration of ERSPAN source session 12:

monitor session 12 type erspan-source
 description SOURCE_SESSION_FOR_VRF_GRAY
 source interface Gi8/48 rx
 destination
  erspan-id 120
  ip address 10.8.1.2
  origin ip address 32.1.1.1
  vrf gray

This example shows the configuration of ERSPAN destination session 12:

monitor session 12 type erspan-destination
 description DEST_SESSION_FOR_VRF_GRAY
 destination interface Gi4/48
 source
  erspan-id 120
  ip address 10.8.1.2
  vrf gray

This example shows the configuration of ERSPAN source session 13:

monitor session 13 type erspan-source
 source interface Gi6/1 tx
 destination
  erspan-id 130
  ip address 10.11.1.1
  origin ip address 32.1.1.1

This example shows the configuration of ERSPAN destination session 13:

monitor session 13 type erspan-destination
 destination interface Gi6/1
 source
  erspan-id 130
  ip address 10.11.1.1


Tip For additional information (including configuration examples and troubleshooting information), see the documents listed on this page:

http://www.cisco.com/en/US/products/hw/routers/ps368/tsd_products_support_series_home.html