Rspan Configuration - Cisco Catalyst 2000 Configuration Handbook

208 Cisco LAN Switching Configuration Handbook
(Optional) Disable a SPAN session:
2.
(global) no monitor session session
SPAN sessions can be disabled individually, referenced by by session number.

RSPAN Configuration

Create one or more VLANs to be used by RSPAN:
1.
(config)vlan vlan_ID{[-vlan_ID] | [,vlan_ID])
(config-vlan) remote-span
The VLAN number vlan-id (1 to 1000, 1025 to 4094) should be created on all
switches from the RSPAN source to the RSPAN destination. As well, the RSPAN
VLAN should be trunked end-to-end because it carries the remotely monitored traf-
fic. Create a different RSPAN VLAN for each RSPAN session that you will be using.
See Chapter 6, "VLANs and Trunking," for more configuration information related
to VLANs and VTP.
Note Notice the use of the rspan keyword when the RSPAN VLAN is created. This must
be used so that the VLAN can correctly carry the RSPAN traffic. An RSPAN-capable
switch floods the RSPAN packets out all its ports belonging to the RSPAN VLAN to send
them toward the RSPAN destination. This is because a switch participating in RSPAN has
no idea where the destination is located.
Otherwise, if the switch were using a regular VLAN, it would try to forward the RSPAN
packets on ports where the packet destination addresses were detected, something quite
different from RSPAN altogether! This is why all switches involved in the end-to-end
RSPAN path must be RSPAN-capable.
Tip Create and maintain the RSPAN VLAN for the special monitoring purpose. Don't
allow any normal hosts to join the RSPAN VLAN.
Ideally, all the switches belong to a common VTP domain so that the VLAN can be created
on a VTP server and propagated to all other switches. VTP pruning also prunes the RSPAN
VLAN from unnecessary trunks, limiting the traffic impact in unrelated areas of the net-
work.
Be aware that RSPAN traffic can increase the traffic load on a trunk, even though RSPAN
is restricted to one special VLAN in the trunk. If the additional load is significant, the nor-
mal and monitored traffic contends with each other for available bandwidth, and both
could suffer.