Cisco 350 Series Administration Manual page 78

Status and Statistics
Switched Port Analyzer (SPAN and RSPAN)
NOTE
Cisco 350, 350X and 550X Series Managed Switches, Firmware Release 2.4, ver 0.4
Remote SPAN
RSPAN extends SPAN by enabling monitoring of multiple switches across your network and
allowing the analyzer port to be defined on a remote switch. In addition to the start (source)
and final (destination) switches, you can define intermediate switches over which the traffic
flows, as shown in Figure
Figure 1 RSPAN Switch Deployment:
Source
Port
1 Start Switch
Define RSPAN VLAN
(ex. 10)
The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is
dedicated for that RSPAN session in all participating switches. The traffic from the source
interfaces on the start device is copied to the RSPAN VLAN through a reflector port and then
forwarded over trunk ports on the intermediate devices to the destination session on the final
switch, which is monitoring the RSPAN VLAN.
The reflector port is the mechanism that copies packets to an RSPAN VLAN. It is a network
port that handles various types of traffic.
The RSPAN VLAN must be configured on all the intermediate switches.
RSPAN does not always successfully copy all the packets when they are arrive from multiple
sources simultaneously. If accurate monitoring is required, the TCAM-based mirror policy can
be used.
RSPAN Workflow
The following workflow describes how to configure the start, intermediate and final switches:
• Start Switch
• Intermediate Switch(es)
• Final Switch
1.
Reflector
Port
Intermediate
3 2
Switch(es)
Define RSPAN VLAN
10 with port 2 and 3 as
members
Source
Port
4 7 Final Switch
Define RSPAN VLAN
10, with port 7 as
member but not port 8
5
Analyzer
Port
8
65