Pen D'Ejo

Lab 9.9.3 Creating a RSPAN Session

Objective
In this lab a Remote Switchport Analyzer (RSPAN) session will be created on two switches to remotely monitor network traffic.

Scenario
Effective monitoring of network traffic in fully switched networks can be challenging. However, the process can be made easier with the inclusion of RSPAN in 2950, 3550, and 6500 series switches. Using RSPAN,LAN traffic received or transmitted by switchports or VLANs can be copied and forwarded to a monitoring port on a remote switch. This mirrored traffic can then be captured and analyzed. A company has recently upgraded to fully switched network architecture. In order to optimize network performance, it has been decided that network traffic should be monitored for analysis purposes. After trying SPANsessions and VSPAN sessions on a single switch it is now time to progress to RSPAN session trials. This will occur by monitoring traffic generated on one switch and using a remote switch port as the destination for the monitored traffic. Protocol analysis software such as Protocol Inspector should be loaded and running on a host that will act as the Remote Monitor (RMON). Two hosts also need to beconfigured with IP addresses in the same subnet so that they will be able to share network traffic.

1-5

CCNP 3: Multilayer Switching v 3.0 - Lab 9.9.3

Copyright  2003, Cisco Systems, Inc.

Step 1
Cable the network devices according to the diagram and configure the hostnames "Server" and "Client3550" in the 2950 and 3550 switches respectively.

Step 2
Enter global configurationmode in the Server switch IOS. Clear any previous monitor sessions:
Server(config)#no monitor session 1

Step 3
From privileged mode, enter the VLAN database and create a VTP server and domain name so that VLAN information can be propagated from the Server switch to the attached Client switch.
Server#vlan database Server(vlan)#vtp server Server(vlan)#vtp domain schnauzer

On the Client 3550enter the VLAN database and create a Virtual Terminal Protocol (VTP) client in the same domain:
Client3550#vlan database Client3550(vlan)#vtp client Client3550(vlan)#vtp domain schnauzer

Step 4
Create a unique VLAN for the RSPAN session. This VLAN will be forwarded through a VLAN trunk to its destination port in exactly the same way as normal traffic. The RSPAN VLAN must be a unique VLAN. Itcannot be a native VLAN of any of the active switch ports:
Server(config)#vlan 901 Server(config-vlan)#remote-span Server(config-vlan)#exit

Step 5
Create the trunk between the Server switch and Client switch. Perform the same procedure on both the Server switch and Client switch:
Server(config)#interface fastethernet 0/2 Server(config-if)#switchport trunk native vlan 99Server(config-if)#switchport mode trunk Client3350(config)#interface fastethernet 0/2 Client3350(config-if)#switchport trunk native vlan 99 Client3350(config-if)#switchport trunk encapsulation dot1q Client3350(config-if)#switchport mode trunk

Step 6
Verify that the trunks are set correctly at both ends using the show interface fastethernet 0/2 trunk command. Output for both switches should indicate that the RSPANVLAN is present on both switches as an allowed VLAN in the schnauzer management domain.
2-5 CCNP 3: Multilayer Switching v 3.0 - Lab 9.9.3 Copyright  2003, Cisco Systems, Inc.

Step 7
The Server switch will be the source for the RSPAN session. Configure two ports as source ports for mirrored traffic: • • Fastethernet port 0/10 will be monitored for bi-directional traffic Fastethernet port0/11 will only be monitored for received traffic
Server(config)#monitor session 1 source interface fastethernet 0/10 both Server(config)#monitor session 1 source interface fastethernet 0/11 rx

Step 8
A reflector port will now be configured on the RSPAN source switch. This is an actual physical port set to loopback mode. In order to redirect copies of the monitored traffic onto the RSPAN VLAN...