Users Guide

Table Of Contents
Monitoring Switch Traffic 571
processing stage. This means that on egress, packets may not appear as
they do on the wire if processing such as VLAN or CoS value rewriting is
programmed.
RSPAN
Administrators should consider reserving a few VLANs across the network for
the exclusive use of RSPAN. The RSPAN VLANs should only be configured
on the reflector interfaces (generally the uplink/transit/downlink interface).
Each RSPAN session must use a unique reflector port, destination port, and
RSPAN VLAN. Reflector ports (source/transit/destination) should be
configured in trunk or general mode and should be members of the RSPAN
VLAN. Do not assign other ports to the RSPAN VLANs.
Mirrored traffic is encapsulated in the RSPAN VLAN on the reflector port on
the source switch. On a source switch, when both an RSPAN VLAN and
reflector port are configured on a trunk or general mode port with other
VLANs, the interface can also carry normal traffic on the other VLANs. For
example, an uplink interface (trunk port) can carry both the RSPAN traffic
and other traffic. Do not configure the RSPAN VLAN as a native VLAN on
interfaces other than the uplink/transit/downlink interfaces. Be sure to
remove the RSPAN VLAN from ports on which mirrored traffic should not be
encapsulated and transported (e.g. trunk ports).
For RSPAN, the original tag is not retained for tagged traffic
received/transmitted at the source port(s).
When configuring VLAN mirroring, the source VLAN cannot be the same as
the RSPAN VLAN. The source VLAN and the destination RSPAN VLAN
cannot be configured on the same port. A source VLAN is mirrored in the
ingress direction only. Careful consideration to placement of VLAN source
mirroring sessions will allow bidirectional traffic to be mirrored using VLAN
mirroring. An alternative is to use port mirroring and a VLAN ACL filter if
duplicate packets are received on the probe device.
Bidirectional mirroring of multiple ports in a network may result in duplicate
packets transmitted on the probe port (one copy for the receive side and
another copy for the transmit side). Configuring the mirroring as RX only
may help to reduce this issue.