So here are the lab tasks. So without further ado, let's go ahead and head over
to server one,
get on the consoles and we'll configure switch to as the source for the ARSPAN
session,
sourcing traffic from gig zero slash one inbound end or outbound traffic. We'll
ship that over to
VLAN 99 and we'll go to switch one and we'll tell it to pick up the data from V
LAN 99 and ship it
over to port three slash three. So let's head over to the lab environment and
let's do the walk through
together. So I took the opportunity to click on reset to reset the lab and I
restarted it and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
restarted it and
it's in the process of restarting right now. So we're nice and fresh without
any existing span or
ARSPAN or ER span configurations. All right, so the lab is reset. Let me go
ahead and just double
click on the lab topology right here on the desktop. That looks good. I'll scoo
ch that down just a
little bit and let's go ahead and double click on server one and they'll give
us access to the
console interfaces for the switches we need to work with. So we'll give that a
moment to initialize.
Here it comes and looking good. So we want to work on switch to first. Let's go
to the switch to tab WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to the switch to tab
here and here on switch to let's go ahead and do a show monitor session all
just to verify we don't
have anything currently in place. And then for our span, we're going to need
our ARSPAN VLAN of
999. Let's do a show VLAN brief and VLAN 999 exists. We also need to tell it if
we want to work with
ARSPAN that it is the ARSPAN VLAN. So we'll go to configuration mode, I'll type
in VLAN 999, not 0 0 0.
And then here we'll type in remote span to tell it that it is the ARSPAN VLAN.
So we'll exit out and
before I forget we'll also do that over on switch one. We'll go to switch one, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
before I forget we'll also do that over on switch one. We'll go to switch one,
big T, do show VLAN
brief and then we'll do a VLAN 999 and remote span. Boom. All right, that's
ready to go as well as far
as the remote span VLAN being identified. So back to switch two we go again
switch two is in the
upper left of our topology here regarding switches and on switch two. As far as
the lab task go it
doesn't say which session number to use and we don't have any currently there.
How about session five
just to mix it up a little bit. So monitor session five. So let's say monitor
session five question WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
session five question
mark and the source is going to be interface gigabit and let's take a look at
our topology
and that was gig zero slash one. So interface gig zero slash one space question
mark and we'll say
both. Now the lab it didn't specify if his inbound traffic on the interface or
outbound. So either
way is great. I'm going to say both ingress and egress traffic. So our next
step that we are collecting
data off of that port. We're going to now going to send it over to our span V
LAN. So to do that
we're going to say monitor session same session number five space question mark WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're going to say monitor session same session number five space question mark
in this time
destination space question mark and then remote space question mark VLAN space
question mark and
999 space question mark and we are done. So we do a show monitor session all
across center.
Here is our remote source session. We're picking up the data in and out of gig
zero slash one and
we're shipping it and copying it over to VLAN 999. So our next step is to go to
switch one
tell it to pick up that data off of our span VLAN 999 and then move it over to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
tell it to pick up that data off of our span VLAN 999 and then move it over to
port gig three
slash three where we would have our protocol analyzer sitting. So let's go to
switch one by
going to the correct switch. We'll do a show monitor session all and we don't
have any yet. So we'll
go to configuration mode. We already specified what the our span of VLAN is
going to be of 999.
So here we'll use monitor session and we don't have to use the same exact
session numbers we did
over on the other switch but I'm going to for consistency. So I'll put five
there space question
mark and I'll say source space question mark and say source is in our hair
instead of saying VLAN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
instead of saying VLAN
which means we want to source traffic from a local VLAN we want to go ahead and
use the keyword
remote space question mark VLAN and then 999 and that way we've specified the
source which is our
rspan VLAN 999. We'll use a similar command of monitor session five but this
time destination
space question mark and based on the lab task we want to send over to gig three
slash three.
So we interface gigabit ethernet three slash three press enter. So now to
verify our work here
on switch two we do a show monitor session all and press enter. We have our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on switch two we do a show monitor session all and press enter. We have our
source session sourcing
it from gig zero slash one traffic going in or out of that port being put onto
VLAN 999 that's
our rspan VLAN and we got to switch one switch one if we do a show monitor
session and press enter
and we'll just show monitor session all to make it happy is pulling the data
off of that rspan
VLAN 999 and shipping it out to gig three slash three. So what I thought would
be fun as an example
of verifying that it's working is let me generate some traffic from this pc at
10.12.051 and let's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
10.12.051 and let's
go ahead and ping the loop back over on R2 that'll cause the ping request to go
in gig zero one and
the replies will be out zero one and that traffic should be captured off that
port and then put
onto the rspan VLAN and then it'd be delivered eventually to that port based on
our lab task
three slash three and to give you a little behind the scenes look I'm going to
behind the scenes
set up a capture just on this trunk link between switch two and switch one
because we should be
able to see if we're capturing that traffic here we should be able to see that
traffic that's going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
traffic that's going
in or out of gig zero one here that traffic should be added to that rspan VLAN
999 and with the
capture on that trunk link we can verify that as well also I want to verify
that we are allowing
VLAN 999 on this trunk so here on switch one we'll show interface trunk just to
verify that 999
is being allowed and it is and we'll do the same thing on switch two show
interface trunk
and press center and sure enough VLAN 999 is being allowed so in the background
I have started a
capture on that trunk link and let's send some traffic from pc 12 so here at pc WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
capture on that trunk link and let's send some traffic from pc 12 so here at pc
12 if we do a
show ip and press center it's at 10 dot 12 dot 0 dot 51 and let's do a ping
from itself over to
2 dot 2 dot 2 dot 2 and that will cause traffic to be sent in through gig zero
one and out for the
replies and that ping is successful so now that I've been capturing in the
background let me show
the capture of traffic on this trunk link right here between switch two and
switch one and here it is
right here let me go ahead and stop that capture and let's look for traffic
from 10 dot 12 dot 0 dot
51 going to 222 and here we go right here so if we grab just that one packet WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
51 going to 222 and here we go right here so if we grab just that one packet
right there I'll go
ahead and double click on it to take a look at the details and we'll expand
that and then let me
minimize the actual packet details right here so we can focus on the actual
packet so this is captured
off of the trunk so as far as the 802 when q tagging is showing right here that
has been tagged with
999 and that's because we pulled it off the trunk and the actual protocols
being carried
that's being shipped over that trunk is the packet going from 10 12 0 51 going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that's being shipped over that trunk is the packet going from 10 12 0 51 going
to 222 and we look at
the details for ICMP it's a ping request so this helps us to verify that that
trunk that VLAN 999
over that trunk was literally carrying that data that was going in and out of
gig zero one here on
its way to be delivered to port three slash three and again here at port three
slash three we want
to have some device that's capable of receiving that data running a protocol
analyzer like wire
shark or some other tool that can collect those packets the ring delivered to
port three slash three
for analysis so we can look at them and see what's going on with our network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for analysis so we can look at them and see what's going on with our network
traffic and again right
here the capture here just confirms that what we thought was happening indeed
was happening so
thanks for joining me in this journey through the world of span our span and er
span and I look forward
to seeing you my friend in another set of videos another hands-on lab in the
very near future until
Until then, I hope this has been informative and I'd like to thank you for
viewing.