Adding additional SPAN port on Cisco switch 2950 not supported : to trunk/cascade with a C2960 without downtime

Posted on 2011-05-11
Medium Priority
Last Modified: 2012-05-11

Currently on one of our Prod Cisco 2950, I have a SPAN port configured
& an IPS device is connected to this SPAN port .  I'm not sure if this SPAN
port is sniffing all traffic that pass thru this switch (ie its backplane?) or
only "monitor source" of a specific port only.

What's the command to find out if this SPAN port is mirroring one port
only (ie sniffing traffic for 1 port only) or sniffing all traffic that passes
thru the entire switch?

I need to add another promiscuous (ie Layer 2) device urgently to
a SPAN port on this switch which collects some other data but
this pair of "trunked-together" Cisco 2950 could only support 1
SPAN port.  I have a spare Cisco 2960, so how can I cascade or
 trunk this spare 2960 (which supports more than 1 SPAN port -
 we've tested that) without causing any downtime to the devices
on this pair of 2950 switches (IPS can be taken out for 30 minutes
to the newly trunked/cascaded 2960)

Kindly give as detailed commands, steps & instructions
Question by:sunhux
  • 7
  • 3
  • 2
LVL 26

Assisted Solution

Soulja earned 400 total points
ID: 35738478
With SPAN you only monitor the source port, not the entire switch.  You should be able to add the addional switch with no downtime. Just ensure the port you are uplinking the new switch to is configured properly as well as the port on the 2950. Make sure the configs of both ports match besides the description.
LVL 26

Assisted Solution

Soulja earned 400 total points
ID: 35738487
Also, make sure you have spanning tree-enabled and port fast turned off on that uplink port.
LVL 14

Accepted Solution

Otto_N earned 1600 total points
ID: 35738600
A1) "show monitor [ session <sess-#> ]" will show the source and destination ports.

A2)  I'll suggest that you connect the 2960 with a trunk-port  to the 2950, and configure RSPAN on the 2950.  First, decide on an unused VLAN number to be used for RSPAN.  On the 2950 and 2960, configure the vlan for RSPAN:

conf t
vlan <VLAN-ID>

Then, on the 2950, change the destination of the monitor session to the VLAN.  But for this, you need a port on the 2950 that use a reflector port.  It must be a physical port, and anything connected to it will lose connectivity as long as the RSPAN session is active.  The config is:

 monitor session <sess-#> destination remote vlan <VLAN-ID> reflector-port <Port-num>

Then, on the 2960, you want to configure multiple destination ports.  Create a monitor session with the RSPAN VLAN as source, and the physical ports as destination:

 monitor session <sess-#> source remote vlan <VLAN-ID>
 monitor session <sess-#> destination interface <Port-num>

Hope this helps...
Restore individual SQL databases with ease

Veeam Explorer for Microsoft SQL Server delivers an easy-to-use, wizard-driven interface for restoring your databases from a backup. No expert SQL background required. Web interface provides a complete view of all available SQL databases to simplify the recovery of lost database


Author Comment

ID: 35738601

Would u be able to provide sample configs for the uplink & downlink ports?

Downlink port on the 2950 & uplink port on 2960?

Or it's just a matter of using cross cables to link the 2960 to the
pair of 2950s & no configuration needed?

Pardon me, as I'm quite a newbie : how do I enable spanning
tree & on which switches do I issue this command (pls provide)
to enable spanning tree?
LVL 14

Assisted Solution

Otto_N earned 1600 total points
ID: 35738871
The uplink/downlink ports on both switches can be configured as follows:
int <Port-num>
 switchport trunk encapsulation dot1q
 switchport mode trunk

You can use cross-cables for the link, but if I remember corectly, these switches support auto-MDI/MDIX, that will detect whther RX is on pin 1&2 or 3&6, so a straight cable should also work.

Spanning-tree is by default enabled, but if you want to tweak it, there is a lot that can be configured.  You can get details for this at http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_53_se/configuration/guide/swtrbl.html (for the 2960) and http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_11_yj4/configuration/guide/lrescg.html (for the 2950).  Handy reference material, but daunting in volume...

Author Comment

ID: 35739653


So Otto_N, with RSPAN (remote span), I don't have to move the IPS device
(or any servers/equipment) which is (are) currently connected to the pair
of 2950s?

Author Comment

ID: 35739733

Btw Otto,  Soulja mentioned that "port fast turned off on that uplink port"
so what's the syntax that we need to add for the uplink interface?
I suppose we don't need to do this on the downlink interface?

Author Comment

ID: 35744058

After configuring RSPAN, connecting a laptop running WireShark to
 the SPAN port on the new 2960 showed hardly any traffic.  What
could be the reason?

Author Comment

ID: 35744239

The Wireshark only displayed multicast & broadcast traffic, so
we're quite curious if there's anything wrong with the way we
trunk the 2960 to the 2950?

Author Comment

ID: 35744265

When I googled for "RSPAN forward multicast traffic", there's some
mention about RSPAN with 2950, so what should I do.  My current
production (which I can't bring down) is a pair of 2950 & I have a pair
of 2960s only (& no other spare switches)
LVL 14

Assisted Solution

Otto_N earned 1600 total points
ID: 35744402
It's been night-time in my timezone, but I'll try to answer these questions:

1) If you want to keep the IPS on the 2950, you just have to create another monitor session on the 2950 with source the RSPAN VLAN and destination the port.  The 2950 only supports 2 RSPAN sessions, of which only one can be a source session.  If the 2950 did support more sessions, you wouldn't need the 2960, as you could create a third monitor session with source the RSPAN VLAN and destination the port of the additional device.

2) "Port Fast" is a spanning-tree protocol (STP) enhancement (by default disabled) that reduce the time STP take before forwarding traffic.  It is supposed to be configured only on access ports (ports that connect only to hosts), and some net-admins configure it by default on all ports that are not connected to other switches at the time of configuration.  If this is the case, and you want to connect a new switch, you will have to disable the Port-fast feature (use the "no spanning-tree portfast" command on the interface).  And it has to match on both ends of the link, so it has to be configured on both switches for the new trunk interfaces.

3) There can be a couple of reasons:  First verify that the trunk port is working and allowing the RSAN VLAN and that the VLAN is active and not in STP Blocking state ("show interface trunk").  Then, using "show monitor" commands, verify that the source and destination on both swithes are correct. (On the 2950: Source = all ports you want monitored, Dest=RSPAN VLAN; on 2960: Source=RSPAN VLAN, Dest=Destination ports).  There are also conditions for the RSPAN VLAN (from the config guides listed above):
– The RSPAN VLAN is not configured as a native VLAN.
– No access port is configured in the RSPAN VLAN.
– VLAN 1,1002-1005 cannot be used as RSPAN VLANs (use the ranges 2-1001 and 1006-4094)

Other reasons for the lack of traffic could be filters on wireshark, or just that there isn't a lot of traffic being monitored.

4)  SPAN and RSPAN also include multicast and broadcast traffic, but not exclusively.  Verify that your source RSP session is set-up for the correct ports and directions (tx, rx or both).

Author Closing Comment

ID: 35746431
Thanks v much

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
Considering cloud tradeoffs and determining the right mix for your organization.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question