Dell EMC Networking OS6 How to Configure RSPAN/Capture Packet Remotely or Port Mirroring in N Series Switches

Index

What is RSPAN
Sample configuration
Configuration
Points to be noted

 

What is RSPAN

Dell EMC Networking N-Series switches support RSPAN destinations where traffic can be tunneled across the operational network. Mirrored traffic is flooded in the RSPAN VLAN from the source to the destination across any intermediate switches.

ALERT:  Reflector port must be a Trunk or General port and RSPAN vlan cannot be the untagged vlan/native.

For this document we are configuring uplink and downlink port as trunk. However we can use general port also. Ensure the RSPAN vlan is tagged vlan in the port.
 

Sample Configuration

Consider following Scenario

• The RSPAN Vlan across the network is 100
• We need to Monitor Port Gi 1/0/1 (in Source-Switch) connecting to Router and the monitoring station is connected to another switch (destination-switch) port Gi1/0/10

SOURCE-SWITCH

Configure RSPAN Vlan
SOURCE-SWITCH(config)#vlan 100
SOURCE-SWITCH(config-vlan100)#remote-span

Configure Downlink port
(connecting to destination switch)
SOURCE-SWITCH(config)#interface gigabitethernet 1/0/5
SOURCE-SWITCH(config-if-Gi1/0/5)#switchport mode trunk
SOURCE-SWITCH(config-if-Gi1/0/5)#switchport trunk allowed vlan add 100

Configure Monitor session
SOURCE-SWITCH(config)#monitor session 1 source interface gigabitethernet 1/0/1
SOURCE-SWITCH(config)#monitor session 1 destination  remote vlan 100 reflector-port gigabitethernet 1/0/5
SOURCE-SWITCH(config)#monitor session 1 mode


DESTINATION-SWITCH

Configure RSPAN Vlan
DESTINATION-SWITCH(config)#vlan 100
DESTINATION-SWITCH(config-vlan100)#remote-span

Configure uplink port
DESTINATION-SWITCH(config)#interface gigabitethernet 1/0/10
DESTINATION-SWITCH(config-if-Gi1/0/10)#switchport trunk allowed vlan add 100
DESTINATION-SWITCH(config-if-Gi1/0/10)#switchport mode trunk

Configure Monitor session
DESTINATION-SWITCH(config)#monitor session 1 source remote vlan 100
DESTINATION-SWITCH(config)#monitor session 1 destination interface gigabitethernet 1/0/15
DESTINATION-SWITCH(config)#monitor session 1 mode

 

Verify

Use command show monitor session <session number>”

Sample output

Source-Switch



Destination-Switch



 

Configuration Syntax

RPAN VLAN

RSPAN Vlan must be configured on the Source and Destination switch
 

Add the RSPAN Vlan in the Downlink (in source) and Uplink (in destination) trunk interface.
 

Source Switch
 

Destination Switch
 

Points to be Noted

• The source can have either physical ports or Vlan. It can not be combination of both.
• We would recommend reserving a unique Vlan ID across the network for Port Monitoring.
• Internal CPU cannot be the source port of RSPAN.
• We can not use RSPAN to capture CPU Traffic generated by source switch like LLDP,ISDP, OSPF etc.
• Each RSPAN session must use a unique reflector port, destination port, and RSPAN VLAN.
• The Transit switch should use same RSPAN vlan id used in source and destination switch   
• Reflector ports (source/transit/destination) should be configured in trunk or general mode and should be members of the RSPAN VLAN. Do not assign other ports to the RSPAN VLANs.
• When configuring VLAN mirroring, the source VLAN cannot be the same as the RSPAN VLAN. The source VLAN and the destination RSPAN VLAN cannot be configured on the same port.
• Packets locally generated by the switch and transmitted over a source port are not mirrored in an RSPAN VLAN mirroring session.
• RSPAN vlan must only be configured in reflector ports
• The ports configured as reflector port can also carry normal traffic and we can allow other vlan to pass through them
• Only One RSPAN session is allowed in a source switch
• RSPAN VLANs must be configured with the remote-span command prior to configuration in an RSPAN session.
• VLAN mirroring is not recommended for RSPAN if sources on multiple switches members of the VLAN are. This is because, as stations communicate with each other over the mirrored VLAN, duplicate packets will be sent to the probe: once for the source port, and once for each switch over which the packet is received in the source VLAN.