WEBVTT

1
00:00.000 --> 00:02.880
In the previous video, we configured span on a single switch.

2
00:02.880 --> 00:05.770
In this video, we're going to go ahead and kick it up a notch and walk through

3
00:05.770 --> 00:06.320
the steps of

4
00:06.320 --> 00:10.880
configuring our span. And as a reminder, our span means we're using two

5
00:10.880 --> 00:12.320
switches at least.

6
00:12.320 --> 00:16.080
In this example, let's go ahead and set up a game plan. Let's go ahead and use

7
00:16.080 --> 00:16.960
switch to as the

8
00:16.960 --> 00:20.680
source once again. So we'll pick up the data or copy the data from gig zero

9
00:20.680 --> 00:21.600
slash one. So the

10
00:21.600 --> 00:26.410
source will be switch to gig zero slash one and let's go ahead and copy traffic

11
00:26.410 --> 00:27.360
going out of that

12
00:27.360 --> 00:31.880
interface egress and in ingress traffic. There'll be both directions. And for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:27.360 --> 00:31.880
interface egress and in ingress traffic. There'll be both directions. And for

13
00:31.880 --> 00:33.040
the destination,

14
00:33.040 --> 00:39.520
we're going to send it over to a R span VLAN. So let's use VLAN 999. We'll

15
00:39.520 --> 00:40.480
dedicate that VLAN

16
00:40.480 --> 00:45.650
999 for the purposes of R span. And then for switch one, we'll tell it to go

17
00:45.650 --> 00:46.720
ahead and for the

18
00:46.720 --> 00:50.940
source that traffic use VLAN 999. And on switch one for the destination, let's

19
00:50.940 --> 00:51.760
go ahead and use

20
00:51.760 --> 00:55.020
port three slash two. And let's imagine we have a protocol analyzer sitting

21
00:55.020 --> 00:56.160
there ready to collect

22
00:56.160 --> 01:00.340
that data and process it. So it'll be part gig three slash two again on switch
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
00:56.160 --> 01:00.340
that data and process it. So it'll be part gig three slash two again on switch

23
01:00.340 --> 01:01.520
one. So that'll be our

24
01:01.520 --> 01:05.940
game plan. So let's head over to switch to and let's begin the configuration of

25
01:05.940 --> 01:06.960
R span. So back

26
01:06.960 --> 01:10.950
at the lab environment, if we do a show monitor session, all we have session

27
01:10.950 --> 01:11.920
one, which we set

28
01:11.920 --> 01:15.720
up in the previous video. And what we'll do now is we can either remove that or

29
01:15.720 --> 01:16.320
we could just

30
01:16.320 --> 01:20.070
create an additional monitor session for R span. Now one of the things we need

31
01:20.070 --> 01:20.880
to do those, make

32
01:20.880 --> 01:25.520
sure that we have a VLAN 999 we can play with. So we'll do a show VLAN brief.

33
01:25.520 --> 01:27.360
And if VLAN 999

34
01:27.360 --> 01:31.110
doesn't exist, we'd want to create it. So there's the VLAN 999 for the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:27.360 --> 01:31.110
doesn't exist, we'd want to create it. So there's the VLAN 999 for the

35
01:31.110 --> 01:33.520
description I said for R span.

36
01:33.520 --> 01:37.920
And let's go to switch one as well. And we'll do a show VLAN brief. Fantastic.

37
01:37.920 --> 01:39.040
It also has a VLAN

38
01:39.040 --> 01:43.450
999 with a description for R span. But that description is not enough. I'll

39
01:43.450 --> 01:44.240
walk through also

40
01:44.240 --> 01:48.500
what we have to do to tell these switches that we want to use that specific V

41
01:48.500 --> 01:49.840
LAN for R span.

42
01:49.840 --> 01:53.340
So because that exists, I just want to verify a show interface trunk that that

43
01:53.340 --> 01:54.240
's being allowed

44
01:54.240 --> 01:59.110
over the trunk. And it is fantastic. I also want to verify that on switch to,

45
01:59.110 --> 01:59.760
which is on the left

46
01:59.760 --> 02:04.380
hand side of our topology here. So up on switch to, let's also show interface
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:59.760 --> 02:04.380
hand side of our topology here. So up on switch to, let's also show interface

47
02:04.380 --> 02:05.440
trunk, just verify

48
02:05.440 --> 02:09.290
that VLAN 999 is allowed over the trunk. Fantastic. So it's going to

49
02:09.290 --> 02:10.960
configuration mode. Now that VLAN

50
02:10.960 --> 02:17.150
999 exists, we also want to specify that VLAN 999 is going to be our remote R

51
02:17.150 --> 02:18.320
span VLAN. And to do

52
02:18.320 --> 02:23.040
that, we go into VLAN configuration mode for that VLAN. With command VLAN 999.

53
02:23.040 --> 02:23.760
Now we're in VLAN

54
02:23.760 --> 02:29.010
configuration mode for VLAN 999. And from here, we're going to use this command

55
02:29.010 --> 02:30.240
right here. Remote
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:29.010 --> 02:30.240
right here. Remote

56
02:30.240 --> 02:35.670
dash span. Just indicating we're going to use that VLAN for remote span. So

57
02:35.670 --> 02:36.560
here we type in remote

58
02:36.560 --> 02:40.140
span press center and we're done. And before I forget, I'm also going to do

59
02:40.140 --> 02:41.360
that over on switch

60
02:41.360 --> 02:47.440
one. So I'll go to switch one and fig T, VLAN 999, and type in remote span

61
02:47.440 --> 02:48.960
press center and boom.

62
02:48.960 --> 02:53.370
It's done. So let's go back to switch two and continue our configuration. So

63
02:53.370 --> 02:53.840
now that we have

64
02:53.840 --> 02:59.200
identified which VLAN we want to use for the remote span VLAN, the next step is

65
02:59.200 --> 03:00.000
to create a new
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:00.000 --> 03:03.650
session to collect data from the port we want. In our case, it's going to be

67
03:03.650 --> 03:04.720
gig zero slash one.

68
03:04.720 --> 03:07.990
Let's confirm that real quick by looking at our topology. Sure enough, gig zero

69
03:07.990 --> 03:08.880
slash one.

70
03:08.880 --> 03:13.520
And then copy that over to the [garbled] band VLAN 999. So to do that, we'll do a do

71
03:13.520 --> 03:14.880
show monitor.

72
03:14.880 --> 03:17.900
And it doesn't like the way I spelled monitor. So I'll fix that. So currently

73
03:17.900 --> 03:19.120
we have session one

74
03:19.120 --> 03:22.440
and we could, you know, remove that and replace it or we could just make

75
03:22.440 --> 03:23.600
another monitor session,

76
03:23.600 --> 03:27.920
which is what I'd like to do. So we'll use monitor session and let's use two. I

77
03:27.920 --> 03:28.960
'll say the source

78
03:28.960 --> 03:32.560
and for the source, let's go ahead and once again use interface and it can
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
03:28.960 --> 03:32.560
and for the source, let's go ahead and once again use interface and it can

79
03:32.560 --> 03:33.280
confirm the interface,

80
03:33.280 --> 03:38.170
which is going to be gig zero slash one that leads up to PC 12 zero slash one

81
03:38.170 --> 03:39.360
space question mark.

82
03:39.360 --> 03:43.280
And then we'll say both for ingress and egress traffic on that interface. So on

83
03:43.280 --> 03:43.840
switch two,

84
03:43.840 --> 03:47.150
that's going to be our source. And for the destination, we'll do monitor

85
03:47.150 --> 03:48.960
session same number two

86
03:48.960 --> 03:51.980
destination. And this time we use a space question mark. We'll put in the

87
03:51.980 --> 03:53.440
keyword remote space,

88
03:53.440 --> 03:57.820
the keyword VLAN. And then we'll specify our remote span VLAN number, which was

89
03:57.820 --> 03:58.800
999.

90
03:58.800 --> 04:03.270
And for us enter, so now if we do a show monitor session and space question
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:58.800 --> 04:03.270
And for us enter, so now if we do a show monitor session and space question

91
04:03.270 --> 04:04.240
mark. So here we can

92
04:04.240 --> 04:07.690
specify all or we'll put the session number in or we can specify the type so I

93
04:07.690 --> 04:08.400
'm going to put

94
04:08.400 --> 04:12.900
all see all of our span sessions. So here for session one, it's a local session

95
04:12.900 --> 04:13.600
that span.

96
04:13.600 --> 04:18.920
And for session two, we have remote span, which is taking traffic in and out of

97
04:18.920 --> 04:20.160
gig zero slash one

98
04:20.160 --> 04:24.960
and replicating that or marrying it over to our remote span VLAN 999. So their

99
04:24.960 --> 04:25.600
half now is to

100
04:25.600 --> 04:29.360
go over to switch one and tell it to go ahead and pick up that captured traffic

101
04:29.360 --> 04:30.400
that's sitting on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:29.360 --> 04:30.400
that's sitting on

102
04:30.400 --> 04:35.090
our span VLAN 999 and then replicated out to the port that we want to send it

103
04:35.090 --> 04:35.840
to. And what we want

104
04:35.840 --> 04:40.050
to do is send it to port three slash two on the switch one. So if we go to the

105
04:40.050 --> 04:40.880
right switch,

106
04:40.880 --> 04:43.960
so we'll go to switch one and now that we're on the right switch, let's do a

107
04:43.960 --> 04:45.280
show monitor session

108
04:45.280 --> 04:49.140
all just to confirm where we're at. And so it has no monitor sessions

109
04:49.140 --> 04:50.080
whatsoever yet.

110
04:50.080 --> 04:53.760
Let's create one. So we'll go into configuration mode, I'll type in monitor

111
04:53.760 --> 04:54.640
session. Now the

112
04:54.640 --> 04:57.860
actual session number on this local switch doesn't have to match the session

113
04:57.860 --> 04:58.880
number on the other

114
04:58.880 --> 05:02.520
switch, but just for consistency, I'm going to go ahead and name it the same
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:58.880 --> 05:02.520
switch, but just for consistency, I'm going to go ahead and name it the same

115
05:02.520 --> 05:03.920
number to the space

116
05:03.920 --> 05:07.240
question mark, we'll say the source space question mark. And for the source, we

117
05:07.240 --> 05:08.160
're using keyword

118
05:08.160 --> 05:11.810
remote, because we're not pulling data from a specific interface or from a

119
05:11.810 --> 05:12.640
specific VLAN,

120
05:12.640 --> 05:16.560
we're using keyword remote, and then we're going to specify the keyword VLAN,

121
05:16.560 --> 05:16.880
and then we're

122
05:16.880 --> 05:21.360
going to specify the remote span VLAN, which is 999 space question mark, and we

123
05:21.360 --> 05:22.160
're set. So now

124
05:22.160 --> 05:25.520
we're going to pull that data from VLAN 999, as far as where we're going to

125
05:25.520 --> 05:26.560
send it on switch one,

126
05:26.560 --> 05:31.220
we'll do a monitor session two, and this time destination. Now we'll define our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
05:26.560 --> 05:31.220
we'll do a monitor session two, and this time destination. Now we'll define our

127
05:31.220 --> 05:32.000
interface,

128
05:32.000 --> 05:35.520
and based on our plan, we say we want to send it to gig three slash two. So we

129
05:35.520 --> 05:37.040
'll send it to interface

130
05:37.040 --> 05:41.310
gig three slash two, press enter. And also one of the really important thing to

131
05:41.310 --> 05:42.400
be aware of

132
05:42.400 --> 05:46.800
for this destination gig of interface here, hopefully we don't have a client

133
05:46.800 --> 05:47.440
sitting there

134
05:47.440 --> 05:50.980
that needs to send data into the network, because once we set up a destination

135
05:50.980 --> 05:51.760
interface with

136
05:51.760 --> 05:57.200
span or our span, traffic is a one way street going over to that destination.

137
05:57.200 --> 05:57.680
And so if there's a

138
05:57.680 --> 06:01.380
client there who's trying to send data into the network, that inbound traffic,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
05:57.680 --> 06:01.380
client there who's trying to send data into the network, that inbound traffic,

139
06:01.380 --> 06:02.080
in this case on

140
06:02.080 --> 06:04.640
gig three slash two is not going to be allowed. So to see our session

141
06:04.640 --> 06:05.840
information here, we do a

142
06:05.840 --> 06:11.110
show monitor session. Now once again, I'm going to specify all press center,

143
06:11.110 --> 06:12.320
and here's our span

144
06:12.320 --> 06:17.340
session. So the type is remote destination session, the source VLAN is 999, and

145
06:17.340 --> 06:18.320
the destination port

146
06:18.320 --> 06:22.270
is gig three slash two. So now that we have walked through the configuration

147
06:22.270 --> 06:23.520
and verification of

148
06:23.520 --> 06:27.780
our span, where we're taking the data off one switch, putting it on our span V

149
06:27.780 --> 06:28.480
LAN, and then

150
06:28.480 --> 06:31.780
collecting that data and sending it to the report on the destination switch. In
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
06:28.480 --> 06:31.780
collecting that data and sending it to the report on the destination switch. In

151
06:31.780 --> 06:32.240
the next video,

152
06:32.240 --> 06:36.850
I'd like to walk you through yet the third option for span, and that is er span

153
06:36.850 --> 06:38.320
leveraging GRE.

154
06:38.320 --> 06:41.680
And we'll do the next video, and I'll see you there in just a moment.