RSPAN on 3550's
Hi guys,
Has anyone else found RSPAN to be unreliable between two 3550s? I initially tried with 2950's but read about some limitations so I changed to 3550s. I've been using rx option on the source port as the both (default) option doesn't work for me:
SW1 with PC connected:
monitor session 1 source interface Fa0/24 rx
monitor session 1 destination remote vlan 90 reflector-port Fa0/15
SW2 with PC connected running WireShark:
monitor session 2 destination interface Fa0/24 (also tried with ingress vlan 1 here)
monitor session 2 source remote vlan 90
VLAN 90 is configured as the RSPAN VLAN. It seems that sometimes I will see ICMP traffic if I ping from the PC connected to Fa0/24 on SW1 and other times I won't. Sometimes if I pull out the cable connected to the monitoring port on SW2 and plug it back in, I will see ICMP traffic in Wireshark, at other times I don't see it.
I've tried removing and re-adding the config which sometimes shows the ICMP traffic in Wireshark, then I'll delete and re-add the config again and I don't see anything until I pull a cable a few times or fiddle with something else...
It seems hit-and-miss...any thoughts?
Has anyone else found RSPAN to be unreliable between two 3550s? I initially tried with 2950's but read about some limitations so I changed to 3550s. I've been using rx option on the source port as the both (default) option doesn't work for me:
SW1 with PC connected:
monitor session 1 source interface Fa0/24 rx
monitor session 1 destination remote vlan 90 reflector-port Fa0/15
SW2 with PC connected running WireShark:
monitor session 2 destination interface Fa0/24 (also tried with ingress vlan 1 here)
monitor session 2 source remote vlan 90
VLAN 90 is configured as the RSPAN VLAN. It seems that sometimes I will see ICMP traffic if I ping from the PC connected to Fa0/24 on SW1 and other times I won't. Sometimes if I pull out the cable connected to the monitoring port on SW2 and plug it back in, I will see ICMP traffic in Wireshark, at other times I don't see it.
I've tried removing and re-adding the config which sometimes shows the ICMP traffic in Wireshark, then I'll delete and re-add the config again and I don't see anything until I pull a cable a few times or fiddle with something else...
It seems hit-and-miss...any thoughts?
ROUTE Passed 1 May 2012
SWITCH Passed 25 September 2012
TSHOOT Passed 23 October 2012
Taking CCNA Security in April 2013 then studying for the CISSP