WEBVTT

1
00:00.000 --> 00:04.010
So here are the lab tasks. So without further ado, let's go ahead and head over

2
00:04.010 --> 00:05.040
to server one,

3
00:05.040 --> 00:09.520
get on the consoles and we'll configure switch to as the source for the ARSPAN

4
00:09.520 --> 00:10.240
session,

5
00:10.240 --> 00:14.880
sourcing traffic from gig zero slash one inbound end or outbound traffic. We'll

6
00:14.880 --> 00:15.680
ship that over to

7
00:15.680 --> 00:18.860
VLAN 99 and we'll go to switch one and we'll tell it to pick up the data from V

8
00:18.860 --> 00:20.400
LAN 99 and ship it

9
00:20.400 --> 00:24.130
over to port three slash three. So let's head over to the lab environment and

10
00:24.130 --> 00:25.280
let's do the walk through

11
00:25.280 --> 00:29.490
together. So I took the opportunity to click on reset to reset the lab and I

12
00:29.490 --> 00:30.560
restarted it and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.490 --> 00:30.560
restarted it and

13
00:30.560 --> 00:34.730
it's in the process of restarting right now. So we're nice and fresh without

14
00:34.730 --> 00:36.320
any existing span or

15
00:36.320 --> 00:40.290
ARSPAN or ER span configurations. All right, so the lab is reset. Let me go

16
00:40.290 --> 00:41.040
ahead and just double

17
00:41.040 --> 00:44.620
click on the lab topology right here on the desktop. That looks good. I'll scoo

18
00:44.620 --> 00:45.680
ch that down just a

19
00:45.680 --> 00:48.830
little bit and let's go ahead and double click on server one and they'll give

20
00:48.830 --> 00:49.600
us access to the

21
00:49.600 --> 00:52.570
console interfaces for the switches we need to work with. So we'll give that a

22
00:52.570 --> 00:54.000
moment to initialize.

23
00:54.000 --> 00:59.040
Here it comes and looking good. So we want to work on switch to first. Let's go

24
00:59.040 --> 01:00.960
to the switch to tab
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:59.040 --> 01:00.960
to the switch to tab

25
01:00.960 --> 01:05.420
here and here on switch to let's go ahead and do a show monitor session all

26
01:05.420 --> 01:06.640
just to verify we don't

27
01:06.640 --> 01:09.960
have anything currently in place. And then for our span, we're going to need

28
01:09.960 --> 01:10.880
our ARSPAN VLAN of

29
01:10.880 --> 01:16.530
999. Let's do a show VLAN brief and VLAN 999 exists. We also need to tell it if

30
01:16.530 --> 01:17.200
we want to work with

31
01:17.200 --> 01:21.340
ARSPAN that it is the ARSPAN VLAN. So we'll go to configuration mode, I'll type

32
01:21.340 --> 01:23.520
in VLAN 999, not 0 0 0.

33
01:23.520 --> 01:27.440
And then here we'll type in remote span to tell it that it is the ARSPAN VLAN.

34
01:27.440 --> 01:28.400
So we'll exit out and

35
01:28.400 --> 01:32.430
before I forget we'll also do that over on switch one. We'll go to switch one,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.400 --> 01:32.430
before I forget we'll also do that over on switch one. We'll go to switch one,

36
01:32.430 --> 01:33.920
big T, do show VLAN

37
01:33.920 --> 01:39.530
brief and then we'll do a VLAN 999 and remote span. Boom. All right, that's

38
01:39.530 --> 01:40.480
ready to go as well as far

39
01:40.480 --> 01:45.280
as the remote span VLAN being identified. So back to switch two we go again

40
01:45.280 --> 01:46.240
switch two is in the

41
01:46.240 --> 01:50.560
upper left of our topology here regarding switches and on switch two. As far as

42
01:50.560 --> 01:51.520
the lab task go it

43
01:51.520 --> 01:55.280
doesn't say which session number to use and we don't have any currently there.

44
01:55.280 --> 01:55.920
How about session five

45
01:55.920 --> 01:59.880
just to mix it up a little bit. So monitor session five. So let's say monitor

46
01:59.880 --> 02:01.040
session five question
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:59.880 --> 02:01.040
session five question

47
02:01.040 --> 02:06.290
mark and the source is going to be interface gigabit and let's take a look at

48
02:06.290 --> 02:07.360
our topology

49
02:07.360 --> 02:12.660
and that was gig zero slash one. So interface gig zero slash one space question

50
02:12.660 --> 02:13.600
mark and we'll say

51
02:13.600 --> 02:18.040
both. Now the lab it didn't specify if his inbound traffic on the interface or

52
02:18.040 --> 02:19.280
outbound. So either

53
02:19.280 --> 02:22.830
way is great. I'm going to say both ingress and egress traffic. So our next

54
02:22.830 --> 02:24.080
step that we are collecting

55
02:24.080 --> 02:27.750
data off of that port. We're going to now going to send it over to our span V

56
02:27.750 --> 02:28.640
LAN. So to do that

57
02:28.640 --> 02:32.990
we're going to say monitor session same session number five space question mark
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:28.640 --> 02:32.990
we're going to say monitor session same session number five space question mark

58
02:32.990 --> 02:33.440
in this time

59
02:33.440 --> 02:39.040
destination space question mark and then remote space question mark VLAN space

60
02:39.040 --> 02:40.240
question mark and

61
02:40.240 --> 02:46.070
999 space question mark and we are done. So we do a show monitor session all

62
02:46.070 --> 02:47.040
across center.

63
02:47.040 --> 02:51.760
Here is our remote source session. We're picking up the data in and out of gig

64
02:51.760 --> 02:52.720
zero slash one and

65
02:52.720 --> 02:56.880
we're shipping it and copying it over to VLAN 999. So our next step is to go to

66
02:56.880 --> 02:57.360
switch one

67
02:57.360 --> 03:01.770
tell it to pick up that data off of our span VLAN 999 and then move it over to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:57.360 --> 03:01.770
tell it to pick up that data off of our span VLAN 999 and then move it over to

68
03:01.770 --> 03:02.720
port gig three

69
03:02.720 --> 03:06.020
slash three where we would have our protocol analyzer sitting. So let's go to

70
03:06.020 --> 03:06.720
switch one by

71
03:06.720 --> 03:10.600
going to the correct switch. We'll do a show monitor session all and we don't

72
03:10.600 --> 03:11.520
have any yet. So we'll

73
03:11.520 --> 03:14.810
go to configuration mode. We already specified what the our span of VLAN is

74
03:14.810 --> 03:16.240
going to be of 999.

75
03:16.240 --> 03:19.360
So here we'll use monitor session and we don't have to use the same exact

76
03:19.360 --> 03:20.240
session numbers we did

77
03:20.240 --> 03:23.830
over on the other switch but I'm going to for consistency. So I'll put five

78
03:23.830 --> 03:24.880
there space question

79
03:24.880 --> 03:29.080
mark and I'll say source space question mark and say source is in our hair

80
03:29.080 --> 03:30.880
instead of saying VLAN
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
03:29.080 --> 03:30.880
instead of saying VLAN

81
03:30.880 --> 03:35.120
which means we want to source traffic from a local VLAN we want to go ahead and

82
03:35.120 --> 03:35.760
use the keyword

83
03:35.760 --> 03:40.860
remote space question mark VLAN and then 999 and that way we've specified the

84
03:40.860 --> 03:42.320
source which is our

85
03:42.320 --> 03:47.140
rspan VLAN 999. We'll use a similar command of monitor session five but this

86
03:47.140 --> 03:48.320
time destination

87
03:48.320 --> 03:51.830
space question mark and based on the lab task we want to send over to gig three

88
03:51.830 --> 03:52.480
slash three.

89
03:52.480 --> 03:56.810
So we interface gigabit ethernet three slash three press enter. So now to

90
03:56.810 --> 03:57.520
verify our work here

91
03:57.520 --> 04:02.010
on switch two we do a show monitor session all and press enter. We have our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:57.520 --> 04:02.010
on switch two we do a show monitor session all and press enter. We have our

92
04:02.010 --> 04:03.440
source session sourcing

93
04:03.440 --> 04:08.050
it from gig zero slash one traffic going in or out of that port being put onto

94
04:08.050 --> 04:09.280
VLAN 999 that's

95
04:09.280 --> 04:13.690
our rspan VLAN and we got to switch one switch one if we do a show monitor

96
04:13.690 --> 04:15.200
session and press enter

97
04:15.200 --> 04:19.020
and we'll just show monitor session all to make it happy is pulling the data

98
04:19.020 --> 04:19.840
off of that rspan

99
04:19.840 --> 04:24.270
VLAN 999 and shipping it out to gig three slash three. So what I thought would

100
04:24.270 --> 04:25.680
be fun as an example

101
04:25.680 --> 04:29.600
of verifying that it's working is let me generate some traffic from this pc at

102
04:29.600 --> 04:31.600
10.12.051 and let's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
04:29.600 --> 04:31.600
10.12.051 and let's

103
04:31.600 --> 04:35.720
go ahead and ping the loop back over on R2 that'll cause the ping request to go

104
04:35.720 --> 04:36.960
in gig zero one and

105
04:36.960 --> 04:41.330
the replies will be out zero one and that traffic should be captured off that

106
04:41.330 --> 04:42.240
port and then put

107
04:42.240 --> 04:46.290
onto the rspan VLAN and then it'd be delivered eventually to that port based on

108
04:46.290 --> 04:47.040
our lab task

109
04:47.040 --> 04:50.730
three slash three and to give you a little behind the scenes look I'm going to

110
04:50.730 --> 04:51.200
behind the scenes

111
04:51.200 --> 04:55.250
set up a capture just on this trunk link between switch two and switch one

112
04:55.250 --> 04:56.240
because we should be

113
04:56.240 --> 04:59.110
able to see if we're capturing that traffic here we should be able to see that

114
04:59.110 --> 05:00.080
traffic that's going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:59.110 --> 05:00.080
traffic that's going

115
05:00.080 --> 05:04.690
in or out of gig zero one here that traffic should be added to that rspan VLAN

116
05:04.690 --> 05:05.840
999 and with the

117
05:05.840 --> 05:09.680
capture on that trunk link we can verify that as well also I want to verify

118
05:09.680 --> 05:10.480
that we are allowing

119
05:10.480 --> 05:15.800
VLAN 999 on this trunk so here on switch one we'll show interface trunk just to

120
05:15.800 --> 05:16.800
verify that 999

121
05:16.800 --> 05:21.230
is being allowed and it is and we'll do the same thing on switch two show

122
05:21.230 --> 05:22.080
interface trunk

123
05:22.080 --> 05:25.960
and press center and sure enough VLAN 999 is being allowed so in the background

124
05:25.960 --> 05:27.040
I have started a

125
05:27.040 --> 05:31.080
capture on that trunk link and let's send some traffic from pc 12 so here at pc
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
05:27.040 --> 05:31.080
capture on that trunk link and let's send some traffic from pc 12 so here at pc

126
05:31.080 --> 05:31.920
12 if we do a

127
05:31.920 --> 05:37.150
show ip and press center it's at 10 dot 12 dot 0 dot 51 and let's do a ping

128
05:37.150 --> 05:38.560
from itself over to

129
05:38.560 --> 05:42.850
2 dot 2 dot 2 dot 2 and that will cause traffic to be sent in through gig zero

130
05:42.850 --> 05:43.840
one and out for the

131
05:43.840 --> 05:48.000
replies and that ping is successful so now that I've been capturing in the

132
05:48.000 --> 05:49.120
background let me show

133
05:49.120 --> 05:53.260
the capture of traffic on this trunk link right here between switch two and

134
05:53.260 --> 05:55.120
switch one and here it is

135
05:55.120 --> 05:58.280
right here let me go ahead and stop that capture and let's look for traffic

136
05:58.280 --> 05:59.920
from 10 dot 12 dot 0 dot

137
05:59.920 --> 06:04.980
51 going to 222 and here we go right here so if we grab just that one packet
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
05:59.920 --> 06:04.980
51 going to 222 and here we go right here so if we grab just that one packet

138
06:04.980 --> 06:05.520
right there I'll go

139
06:05.520 --> 06:09.730
ahead and double click on it to take a look at the details and we'll expand

140
06:09.730 --> 06:10.240
that and then let me

141
06:10.240 --> 06:13.960
minimize the actual packet details right here so we can focus on the actual

142
06:13.960 --> 06:15.280
packet so this is captured

143
06:15.280 --> 06:20.410
off of the trunk so as far as the 802 when q tagging is showing right here that

144
06:20.410 --> 06:21.520
has been tagged with

145
06:21.520 --> 06:25.270
999 and that's because we pulled it off the trunk and the actual protocols

146
06:25.270 --> 06:26.000
being carried

147
06:26.000 --> 06:31.340
that's being shipped over that trunk is the packet going from 10 12 0 51 going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
06:26.000 --> 06:31.340
that's being shipped over that trunk is the packet going from 10 12 0 51 going

148
06:31.340 --> 06:32.720
to 222 and we look at

149
06:32.720 --> 06:38.020
the details for ICMP it's a ping request so this helps us to verify that that

150
06:38.020 --> 06:39.760
trunk that VLAN 999

151
06:39.760 --> 06:43.740
over that trunk was literally carrying that data that was going in and out of

152
06:43.740 --> 06:44.800
gig zero one here on

153
06:44.800 --> 06:48.590
its way to be delivered to port three slash three and again here at port three

154
06:48.590 --> 06:49.440
slash three we want

155
06:49.440 --> 06:52.840
to have some device that's capable of receiving that data running a protocol

156
06:52.840 --> 06:53.840
analyzer like wire

157
06:53.840 --> 06:57.040
shark or some other tool that can collect those packets the ring delivered to

158
06:57.040 --> 06:58.320
port three slash three

159
06:58.320 --> 07:01.970
for analysis so we can look at them and see what's going on with our network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
06:58.320 --> 07:01.970
for analysis so we can look at them and see what's going on with our network

160
07:01.970 --> 07:02.960
traffic and again right

161
07:02.960 --> 07:07.390
here the capture here just confirms that what we thought was happening indeed

162
07:07.390 --> 07:08.240
was happening so

163
07:08.240 --> 07:13.040
thanks for joining me in this journey through the world of span our span and er

164
07:13.040 --> 07:14.160
span and I look forward

165
07:14.160 --> 07:17.550
to seeing you my friend in another set of videos another hands-on lab in the

166
07:17.550 --> 07:19.040
very near future until

167
07:19.040 --> 07:22.890
Until then, I hope this has been informative and I'd like to thank you for

168
07:22.890 --> 07:23.280
viewing.