This article provides instructions on how you can configure Remote Switch Port Analyzer (RSPAN) on your CBS220 series switches.
Switch Port Analyzer (SPAN), or sometimes called port mirroring or port monitoring, chooses network traffic for analysis by a network analyzer. The network analyzer can be a Cisco SwitchProbe device or other Remote Monitoring (RMON) probe.
The switch creates a copy of the traffic activity on a given port or VLAN and sends this copy to the port that is connected to the analyzer network/device. You can apply this feature to monitor the traffic activity on a given port and check for intruders that want to break into your network, which provides security to your network and its resources. A network analyzer connected to the monitoring port processes the data packets for diagnosing, debugging, and performance monitoring.
Remote Switch Port Analyzer (RSPAN) is an extension of SPAN. RSPAN extends SPAN by enabling monitoring of multiple switches across your network and allowing the analyzer port to be defined on a remote switch. This means that you can centralize your network capture devices.
RSPAN works by mirroring the traffic from the source ports of an RSPAN session onto a VLAN that is dedicated for the RSPAN session. This VLAN is then trunked to other switches, allowing the RSPAN session traffic to be transported across multiple switches. On the switch that contains the destination port for the session, traffic from the RSPAN session VLAN is simply mirrored out the destination port.
RSPAN Traffic Flow
RSPAN Port Membership Rules
The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. It has these special characteristics:
Log in to the web user-interface (UI) of the Start Switch.
Choose VLAN Management > VLAN Settings.
Click Add.
Enter the RSPAN VLAN number in the VLAN field, a VLAN Name, and click Apply.
To learn more about configuring VLAN, check out the article on Configure VLAN on Cisco Business 220 Series Switches.
(Optional) Click Save to update the running configuration file.
Choose Status and Statistics > SPAN & RSPAN > RSPAN VLAN.
Choose a VLAN ID from the RSPAN VLAN drop-down list. This VLAN should be exclusively used for RSPAN.
In this example, VLAN 200 is chosen.
Click Apply.
(Optional) Click Save to update the running configuration file.
In the Final Switch, repeat steps 1 to 9 to configure RSPAN VLAN.
You have now configured the VLAN that is dedicated to the RSPAN session on both Start and Final Switches.
In a single local SPAN or RSPAN session source, you can monitor the port traffic, such as received (Rx), transmitted (Tx), or bidirectional (both). The switch supports any number of source ports (up to the maximum number of available ports on the switch) and any number of source VLANs. To configure the source ports to be mirrored, follow these steps:
Choose Status and Statistics > SPAN & RSPAN > Session Sources.
Click Add.
Choose the session number from the Session ID drop-down list. Session ID must be consistent per RSPAN session.
In this example, Session 1 is chosen.
Click the radio button for the desired Source Interface from the drop-down menu.
The Source Interface cannot be the same as the Destination Port.
The options are:
In this example, port GE2 is chosen.
(Optional) If Port is selected in Step 4, click the desired Monitor Type radio button for the type of traffic to monitor.
The options are:
In this example, Rx and Tx is chosen.
Click Apply.
(Optional) Click Save to update the running configuration file.
You have now configured the session source on your Start Switch.
A monitoring session consists of one or more source ports and a single destination port. A destination port must be configured on the start and final devices. On the start device, this is the reflector port. On the final device, it is the analyzer port. To add a destination port, follow these steps:
Choose Status and Statistics > SPAN & RSPAN > Session Destinations.
Click Add.
Choose the session number from the Session ID drop-down list. It must be the same as the chosen ID from the configured session source.
In this example, Session 1 is chosen.
Click the Remote VLAN radio button from the Destination Type field.
The Destination Interface cannot be the same as the Source Port. If Remote VLAN is chosen, the Network Traffic is automatically enabled.
In the Reflector Port field, choose the desired option from the drop-down list.
Click Apply.
(Optional) Click Save to update the running configuration file.
You have now configured the session destinations on your Start Switch.
Choose Status and Statistics > SPAN & RSPAN > Session Sources.
Click Add.
(Optional) Choose the session number from the Session ID drop-down list. Session ID must be consistent per session.
In this example, Session 1 is chosen.
Click the Remote VLAN radio button in the Source Interface field.
The Monitor Type of the Remote VLAN will be automatically configured.
Click Apply then click Close.
(Optional) Click Save to update the running configuration file.
You have now configured the session sources on your Final Switch.
Choose Status and Statistics > SPAN & RSPAN > Session Destinations.
Click Add.
Choose the session number from the Session ID drop-down list. It must be the same as the chosen ID from the configured session source.
In this example, Session 1 is chosen.
Click Local radio button in the Destination Type field.
In the Port field, choose the desired option from drop-down list.
In this example, port GE3 is chosen.
(Optional) In the Network Traffic field, check the Enable check box to enable network traffic.
Click Apply then click Close.
(Optional) Click Save to update the running configuration file.
You have now configured the session destinations on your Final Switch.
You did it! You have successfully configured the RSPAN session on your CBS220 switches.