In the previous video, we configured span on a single switch.
In this video, we're going to go ahead and kick it up a notch and walk through
the steps of
configuring our span. And as a reminder, our span means we're using two
switches at least.
In this example, let's go ahead and set up a game plan. Let's go ahead and use
switch to as the
source once again. So we'll pick up the data or copy the data from gig zero
slash one. So the
source will be switch to gig zero slash one and let's go ahead and copy traffic
going out of that
interface egress and in ingress traffic. There'll be both directions. And for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
interface egress and in ingress traffic. There'll be both directions. And for
the destination,
we're going to send it over to a R span VLAN. So let's use VLAN 999. We'll
dedicate that VLAN
999 for the purposes of R span. And then for switch one, we'll tell it to go
ahead and for the
source that traffic use VLAN 999. And on switch one for the destination, let's
go ahead and use
port three slash two. And let's imagine we have a protocol analyzer sitting
there ready to collect
that data and process it. So it'll be part gig three slash two again on switch WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that data and process it. So it'll be part gig three slash two again on switch
one. So that'll be our
game plan. So let's head over to switch to and let's begin the configuration of
R span. So back
at the lab environment, if we do a show monitor session, all we have session
one, which we set
up in the previous video. And what we'll do now is we can either remove that or
we could just
create an additional monitor session for R span. Now one of the things we need
to do those, make
sure that we have a VLAN 999 we can play with. So we'll do a show VLAN brief.
And if VLAN 999
doesn't exist, we'd want to create it. So there's the VLAN 999 for the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
doesn't exist, we'd want to create it. So there's the VLAN 999 for the
description I said for R span.
And let's go to switch one as well. And we'll do a show VLAN brief. Fantastic.
It also has a VLAN
999 with a description for R span. But that description is not enough. I'll
walk through also
what we have to do to tell these switches that we want to use that specific V
LAN for R span.
So because that exists, I just want to verify a show interface trunk that that
's being allowed
over the trunk. And it is fantastic. I also want to verify that on switch to,
which is on the left
hand side of our topology here. So up on switch to, let's also show interface WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
hand side of our topology here. So up on switch to, let's also show interface
trunk, just verify
that VLAN 999 is allowed over the trunk. Fantastic. So it's going to
configuration mode. Now that VLAN
999 exists, we also want to specify that VLAN 999 is going to be our remote R
span VLAN. And to do
that, we go into VLAN configuration mode for that VLAN. With command VLAN 999.
Now we're in VLAN
configuration mode for VLAN 999. And from here, we're going to use this command
right here. Remote WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right here. Remote
dash span. Just indicating we're going to use that VLAN for remote span. So
here we type in remote
span press center and we're done. And before I forget, I'm also going to do
that over on switch
one. So I'll go to switch one and fig T, VLAN 999, and type in remote span
press center and boom.
It's done. So let's go back to switch two and continue our configuration. So
now that we have
identified which VLAN we want to use for the remote span VLAN, the next step is
to create a new WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
session to collect data from the port we want. In our case, it's going to be
gig zero slash one.
Let's confirm that real quick by looking at our topology. Sure enough, gig zero
slash one.
And then copy that over to the [garbled] band VLAN 999. So to do that, we'll do a do
show monitor.
And it doesn't like the way I spelled monitor. So I'll fix that. So currently
we have session one
and we could, you know, remove that and replace it or we could just make
another monitor session,
which is what I'd like to do. So we'll use monitor session and let's use two. I
'll say the source
and for the source, let's go ahead and once again use interface and it can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and for the source, let's go ahead and once again use interface and it can
confirm the interface,
which is going to be gig zero slash one that leads up to PC 12 zero slash one
space question mark.
And then we'll say both for ingress and egress traffic on that interface. So on
switch two,
that's going to be our source. And for the destination, we'll do monitor
session same number two
destination. And this time we use a space question mark. We'll put in the
keyword remote space,
the keyword VLAN. And then we'll specify our remote span VLAN number, which was
999.
And for us enter, so now if we do a show monitor session and space question WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for us enter, so now if we do a show monitor session and space question
mark. So here we can
specify all or we'll put the session number in or we can specify the type so I
'm going to put
all see all of our span sessions. So here for session one, it's a local session
that span.
And for session two, we have remote span, which is taking traffic in and out of
gig zero slash one
and replicating that or marrying it over to our remote span VLAN 999. So their
half now is to
go over to switch one and tell it to go ahead and pick up that captured traffic
that's sitting on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that's sitting on
our span VLAN 999 and then replicated out to the port that we want to send it
to. And what we want
to do is send it to port three slash two on the switch one. So if we go to the
right switch,
so we'll go to switch one and now that we're on the right switch, let's do a
show monitor session
all just to confirm where we're at. And so it has no monitor sessions
whatsoever yet.
Let's create one. So we'll go into configuration mode, I'll type in monitor
session. Now the
actual session number on this local switch doesn't have to match the session
number on the other
switch, but just for consistency, I'm going to go ahead and name it the same WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
switch, but just for consistency, I'm going to go ahead and name it the same
number to the space
question mark, we'll say the source space question mark. And for the source, we
're using keyword
remote, because we're not pulling data from a specific interface or from a
specific VLAN,
we're using keyword remote, and then we're going to specify the keyword VLAN,
and then we're
going to specify the remote span VLAN, which is 999 space question mark, and we
're set. So now
we're going to pull that data from VLAN 999, as far as where we're going to
send it on switch one,
we'll do a monitor session two, and this time destination. Now we'll define our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we'll do a monitor session two, and this time destination. Now we'll define our
interface,
and based on our plan, we say we want to send it to gig three slash two. So we
'll send it to interface
gig three slash two, press enter. And also one of the really important thing to
be aware of
for this destination gig of interface here, hopefully we don't have a client
sitting there
that needs to send data into the network, because once we set up a destination
interface with
span or our span, traffic is a one way street going over to that destination.
And so if there's a
client there who's trying to send data into the network, that inbound traffic, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
client there who's trying to send data into the network, that inbound traffic,
in this case on
gig three slash two is not going to be allowed. So to see our session
information here, we do a
show monitor session. Now once again, I'm going to specify all press center,
and here's our span
session. So the type is remote destination session, the source VLAN is 999, and
the destination port
is gig three slash two. So now that we have walked through the configuration
and verification of
our span, where we're taking the data off one switch, putting it on our span V
LAN, and then
collecting that data and sending it to the report on the destination switch. In WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
collecting that data and sending it to the report on the destination switch. In
the next video,
I'd like to walk you through yet the third option for span, and that is er span
leveraging GRE.
And we'll do the next video, and I'll see you there in just a moment.