Switch – How to monitor SPAN port for a routed port on 3560G

mirrorrouterswitch

Is configuring the SPAN port same for a routed port vs a switch port?

I have a routed port on my layer-3 3560G for which I need to configure SPAN and capture packets ingress and egress for troubleshooting.

Here is the configuration on the source port:

interface GigabitEthernet0/23
 description Uplink to ISP
 no switchport
 ip address X.x.x.x y.y.y.y
 load-interval 30
 speed 100
 duplex full
end

Here is what I have configured:

monitor session 1 source interface Gi0/23
monitor session 1 destination interface Gi0/5

Is SPAN port configuration different on a switch port vs routed port?

Also, how do we configure SPAN port on a router?

Best Answer

A routed port is specifically not a switch port. You are putting the no switchport command on the port to disable the switching functions. It becomes a router interface.

SPAN will not work on a switch port which is routed. Some Cisco devices (very few) can use ERSPAN to route SPAN traffic, but the 3560G is not one of them. SPAN and RSPAN are layer-2 only and ERSPAN is across layer-3.

Understanding SPAN,RSPAN,and ERSPAN

Local SPAN: Mirrors traffic from one or more interface on the switch to one or more interfaces on the same switch.

Remote SPAN (RSPAN): An extension of SPAN called remote SPAN or RSPAN. RSPAN allows you to monitor traffic from source ports distributed over multiple switches, which means that you can centralize your network capture devices. RSPAN works by mirroring the traffic from the source ports of an RSPAN session onto a VLAN that is dedicated for the RSPAN session. This VLAN is then trunked to other switches, allowing the RSPAN session traffic to be transported across multiple switches. On the switch that contains the destination port for the session, traffic from the RSPAN session VLAN is simply mirrored out the destination port.

Encapsulated remote SPAN (ERSPAN): encapsulated Remote SPAN (ERSPAN), as the name says, brings generic routing encapsulation (GRE) for all captured traffic and allows it to be extended across Layer 3 domains.

ERSPAN is a Cisco proprietary feature and is available only to Catalyst 6500, 7600, Nexus, and ASR 1000 platforms to date. The ASR 1000 supports ERSPAN source (monitoring) only on Fast Ethernet, Gigabit Ethernet, and port-channel interfaces.

Update:

The latest information I have is that Cisco is planning to add ERSPAN support to some Catalyst 3K and 4K switches in code versions to be released later in 2016, albeit there were no guarantees.

Related Topic