Multiple VLANs mirroring

Hello,

 

I'll note we don't typically do initial configuration in the forum. We do have Deployment Services available if you need that.

This information may be what you are looking for:

 

Remote span is used when there are 2 switches involved.

The source port is on the first switch and the monitoring station on the second switch. The RSPAN vlan is just used to pass traffic from the first switch to the second. Reflector-port command is used to configure the port on the source switch which is connected to the destination switch, it is not the port where the monitoring station is. Note that a stack is considered one switch.

 

If the uplink between the 2 switches is a port-channel, we'll have to make another physical connection between the switches. And allow only the RSPAN VLAN through the interface in trunk mode. The native VLAN should also be set to RSPAN VLAN on the new connection. The RSPAN VLAN should be removed from the other uplink, to prevent a loop.

You can use this to configure RSPAN.

Summary: This article explains how to remote capture packets (RSPAN) in N series switches

https://dell.to/3QpF2dx

 

 

If your source and destination port (monitoring device) are on the same switch (or stack), you do not have to use RSPAN.

Up to four active sessions mirroring traffic in a single direction and with unique destinations are supported on N30xx. Each session supports multiple sources. However, the destination interface for a session may not overlap with other sessions.

You can read on Page 718-722 about what are the requirement to do with the monitoring.

https://dell.to/431i3gi

 

Thank you Charles

It looks like i cannot create more than one monitoring session, when i try adding the second session i get this error:

Value is out of range. The valid range is 1 to 1.

Note, the session i am trying to create is for adding a second vlan to the monitor

Hello,

 

Assuming you are using only one switch/stack and the source and the destination interfaces are on the same switch/stack (not RSPAN like you were trying to configure initially), I see you are getting a different message when trying to add a second session.

Each session supports multiple sources. So you can use only session 1 and try to add a second source for session 1.

Your destination port gi3/0/46 for the monitoring device will be the same on both lines, because the destination interface for a session may not overlap with other sessions.

VLAN based mirroring is applicable only for ingress (RX) traffic, so you should specify RX only.

no way...

NET-xxx(config)#monitor session 1 source vlan 90 rx

Configuration data could not be added.

Hello,

Actually you are correct, there is a limitation: “VLAN interfaces may be configured as a source for monitor sessions, but configured monitor sessions are limited to no more than 1 source VLAN across all configured monitoring sessions. “ If it is physical interfaces, it can be several source physical interfaces going to the same destination but source vlan can be only one.