30-10
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
OL-12247-04
Chapter 30 Configuring SPAN and RSPAN
Understanding Flow-Based SPAN
A physical port that belongs to an EtherChannel group can be configured as a SPAN source port and
still be a part of the EtherChannel. In this case, data from the physical port is monitored as it
participates in the EtherChannel. However, if a physical port that belongs to an EtherChannel group
is configured as a SPAN destination, it is removed from the group. After the port is removed from
the SPAN session, it rejoins the EtherChannel group. Ports removed from an EtherChannel group
remain members of the group, but they are in the
inactive
or
suspended
state.
If a physical port that belongs to an EtherChannel group is a destination port and the EtherChannel
group is a source, the port is removed from the EtherChannel group and from the list of monitored
ports.
•
Multicast traffic can be monitored. For egress and ingress port monitoring, only a single unedited
packet is sent to the SPAN destination port. It does not reflect the number of times the multicast
packet is sent.
•
A private-VLAN port cannot be a SPAN destination port.
•
A secure port cannot be a SPAN destination port.
For SPAN sessions, do not enable port security on ports with monitored egress when ingress
forwarding is enabled on the destination port. For RSPAN source sessions, do not enable port
security on any ports with monitored egress.
•
An IEEE 802.1x port can be a SPAN source port. You can enable IEEE 802.1x on a port that is a
SPAN destination port; however, IEEE 802.1x is disabled until the port is removed as a SPAN
destination.
For SPAN sessions, do not enable IEEE 802.1x on ports with monitored egress when ingress
forwarding is enabled on the destination port. For RSPAN source sessions, do not enable
IEEE 802.1x on any ports that are egress monitored.
SPAN and RSPAN and Switch Stacks
Because the stack of switches is treated as one logical switch, local SPAN source ports and destination
ports can be in different switches in the stack. Therefore, the addition or deletion of switches in the stack
can affect a local SPAN session, as well as an RSPAN source or destination session. An active session
can become inactive when a switch is removed from the stack or an inactive session can become active
when a switch is added to the stack.
For more information about switch stacks, see
Chapter 5, “Managing Switch Stacks.”
Understanding Flow-Based SPAN
You can control the type of network traffic to be monitored in SPAN or RSPAN sessions by using
flow-based SPAN (FSPAN) or flow-based RSPAN (FRSPAN), which apply access control lists (ACLs)
to the monitored traffic on the source ports. The FSPAN ACLs can be configured to filter IPv4, IPv6,
and non-IP monitored traffic.
You apply an ACL to a SPAN session through the interface. It is applied to all the traffic that is
monitored on all interfaces in the SPAN session.The packets that are permitted by this ACL are copied
to the SPAN destination port. No other packets are copied to the SPAN destination port.
The original traffic continues to be forwarded, and any port, VLAN, and router ACLs attached are
applied. The FSPAN ACL does not have any effect on the forwarding decisions. Similarly, the port,
VLAN, and router ACLs do not have any effect on the traffic monitoring. If a security input ACL denies
a packet and it is not forwarded, the packet is still copied to the SPAN destination ports if the FSPAN
