Unsolved
3 Posts
0
442
February 13th, 2023 14:00
RSPAN with 2 core switches and several access switches
I'm looking for configuration guidance when attempting to monitor multiple access switch VLANs and sending the captured traffic to the core switches via an RSPAN VLAN.
I'm using s4048t-on as 2x core and 4x access switches. I'm also using N3248P-on as 2x access switches.
I understand how to run RSPAN from a single access switch to the core switch, however, I'm wondering how to allow RSPAN traffic, at the same time, from the other access switches. More specifically, on the core switch, since I can only create a single monitor session when using RSPAN, if I add the RSPAN VLAN to the other access switches, will I cause problems by having that capture traffic replicate to all switches that are using the RSPAN VLAN?
I haven't found a real-world configuration with this topology - all the documentation, youtube videos, etc., only describe a single source, a transit switch, and a destination switch. Nothing about capturing from multiple access switches!
Thank you,
Rob.
DELL-Young E
Moderator
•
5.1K Posts
0
February 13th, 2023 20:00
Hello thanks for choosing Dell. I hope it helps: https://dell.to/3lANcDX
https://dl.dell.com/topicspdf/dell-emc-os-9_users-guide19_en-us.pdf
rcervantez
3 Posts
0
February 14th, 2023 09:00
Thank you, however, I have already read this guide. I do not see anything in that documentation that addresses my question about the RSPAN VLAN across multiple access switches.
If, for example, I'm using VLAN 1000 as the RSPAN VLAN, and that vlan is configured as a RSPAN VLAN on the core AND access switches, will traffic sent to RSPAN VLAN 1000 on access1 switch be flooded to other access2/3/4/5/6 switches VLAN 1000 (via the core)?
Thank you.
DELL-Chris H
Moderator
•
9.4K Posts
0
February 14th, 2023 11:00
Rcervantez,
You can find information on RSPAN, as well as an example configuration, on page 1664 here.
Let me know if this helps.
DELL-Chris H
Moderator
•
9.4K Posts
0
February 14th, 2023 12:00
Sorry about that, i wasn't sure on what OS you were sing, as both listed switches support both. As far as what you are trying to do, we can continue researching it, but from what i am seeing it isn't supported to do it from multiple sources.
Let me see if I can find anything to confirm that.
rcervantez
3 Posts
0
February 14th, 2023 12:00
Chris H,
Thank you for the response. I had not seen that OS10 documenation since I'm running OS9. There are some slight syntax differences, however, the example in that guide still does not address my concern. That example shows a single RSPAN source and destination but not multiple source switches to a single destination switch.
Also, it seems that either there are typos/misconfigurations or the mirroring process has changed in OS10. For example, on pages 1664-1666, only the vlan on source "switch 1" is of type R (remote-mirroring). The output on switches2-4 don't show that designation of R.
Thank you,
Rob.
Dave191
1 Rookie
•
8 Posts
0
October 23rd, 2023 22:47
@rcervantez Did you ever get this sorted?? I am looking at a similar setup on our network as we have engaged a security/monitoring solution whose architects want me to enable RSPAN across our network (about 50 switches and several stacks plus our Core Stack) to monitor/classify data moving across the network and this concerns me greatly as well.
Cheers!