Cisco IE 4000, Software Configuration Manual

Page: 476 / 1066

472
Configuring SPAN and RSPAN
Information About SPAN and RSPAN
SPAN and RSPAN Interaction with Other Features

Routing—SPAN does not monitor routed traffic. VSPAN only monitors traffic that enters or exits the switch, not traffic
that is routed between VLANs. For example, if a VLAN is being Rx-monitored and the switch routes traffic from
another VLAN to the monitored VLAN, that traffic is not monitored and not received on the SPAN destination port.

STP—A destination port does not participate in STP while its SPAN or RSPAN session is active. The destination port
can participate in STP after the SPAN or RSPAN session is disabled. On a source port, SPAN does not affect the STP
status. STP can be active on trunk ports carrying an RSPAN VLAN.

CDP—A SPAN destination port does not participate in CDP while the SPAN session is active. After the SPAN session
is disabled, the port again participates in CDP.

VTP—You can use VTP to prune an RSPAN VLAN between switches.

VLAN and trunking—You can modify VLAN membership or trunk settings for source or destination ports at any time.
However, changes in VLAN membership or trunk settings for a destination port do not take effect until you remove
the SPAN destination configuration. Changes in VLAN membership or trunk settings for a source port immediately
take effect, and the respective SPAN sessions automatically adjust accordingly.

EtherChannel—You can configure an EtherChannel group as a source port but not as a SPAN destination port. When
a group is configured as a SPAN source, the entire group is monitored.
If a physical port is added to a monitored EtherChannel group, the new port is added to the SPAN source port list. If
a port is removed from a monitored EtherChannel group, it is automatically removed from the source port list.
A physical port that belongs to an EtherChannel group can be configured as a SPAN source port and still be a part
of the EtherChannel. In this case, data from the physical port is monitored as it participates in the EtherChannel.
However, if a physical port that belongs to an EtherChannel group is configured as a SPAN destination, it is removed
from the group. After the port is removed from the SPAN session, it rejoins the EtherChannel group. Ports removed
from an EtherChannel group remain members of the group, but they are in the
inactive or suspended state.
If a physical port that belongs to an EtherChannel group is a destination port and the EtherChannel group is a source,
the port is removed from the EtherChannel group and from the list of monitored ports.

Multicast traffic can be monitored. For egress and ingress port monitoring, only a single unedited packet is sent to
the SPAN destination port. It does not reflect the number of times the multicast packet is sent.

A private-VLAN port cannot be a SPAN destination port.

A secure port cannot be a SPAN destination port.
For SPAN sessions, do not enable port security on ports with monitored egress when ingress forwarding is enabled
on the destination port. For RSPAN source sessions, do not enable port security on any ports with monitored egress.

An IEEE 802.1x port can be a SPAN source port. You can enable IEEE 802.1x on a port that is a SPAN destination
port; however, IEEE 802.1x is disabled until the port is removed as a SPAN destination.
For SPAN sessions, do not enable IEEE 802.1x on ports with monitored egress when ingress forwarding is enabled
on the destination port. For RSPAN source sessions, do not enable IEEE 802.1x on any ports that are egress
monitored.
Local SPAN Configuration Guidelines

For SPAN sources, you can monitor traffic for a single port or VLAN or a series or range of ports or VLANs for each
session. You cannot mix source ports and source VLANs within a single SPAN session.

The destination port cannot be a source port; a source port cannot be a destination port.

You cannot have two SPAN sessions using the same destination port.