Cisco CCNA Packet Tracer Ultimate labs: Remote SPAN: Answers

#CCNA #PacketTracer #CCENT

Local SPAN-The SPAN feature is local when the monitored ports are all located on the same switch as the destination port. This feature is in contrast to Remote SPAN (RSPAN), which this list also defines.

Remote SPAN (RSPAN)-Some source ports are not located on the same switch as the destination port. RSPAN is an advanced feature that requires a special VLAN to carry the traffic that is monitored by SPAN between switches. RSPAN is not supported on all switches. Check the respective release notes or configuration guide to see if you can use RSPAN on the switch that you deploy.

Port-based SPAN (PSPAN)-The user specifies one or several source ports on the switch and one destination port.

VLAN-based SPAN (VSPAN)-On a particular switch, the user can choose to monitor all the ports that belong to a particular VLAN in a single command.

Local SPAN Overview
A local SPAN session is an association of source ports and source VLANs with one or more destinations. You configure a local SPAN session on a single switch. Local SPAN does not have separate source and destination sessions.

Local SPAN sessions do not copy locally sourced RSPAN VLAN traffic from source trunk ports that carry RSPAN VLANs. Local SPAN sessions do not copy locally sourced RSPAN GRE-encapsulated traffic from source ports.

Each local SPAN session can have either ports or VLANs as sources, but not both.

You can analyze network traffic passing through ports or VLANs by using SPAN or RSPAN to send a copy of the traffic to another port on the switch or on another switch that has been connected to a network analyzer or other monitoring or security device. SPAN copies (or mirrors) traffic received or sent (or both) on source ports or source VLANs to a destination port for analysis. SPAN does not affect the switching of network traffic on the source ports or VLANs. You must dedicate the destination port for SPAN use. Except for traffic that is required for the SPAN or RSPAN session, destination ports do not receive or forward traffic.

Only traffic that enters or leaves source ports or traffic that enters or leaves source VLANs can be monitored by using SPAN; traffic routed to a source VLAN cannot be monitored. For example, if incoming traffic is being monitored, traffic that gets routed from another VLAN to the source VLAN cannot be monitored; however, traffic that is received on the source VLAN and routed to another VLAN can be monitored.

You can use the SPAN or RSPAN destination port to inject traffic from a network security device. For example, if you connect a Cisco Intrusion Detection System (IDS) sensor appliance to a destination port, the IDS device can send TCP reset packets to close down the TCP session of a suspected attacker.

Local SPAN supports a SPAN session entirely within one switch; all source ports or source VLANs and destination ports are in the same switch or switch stack. Local SPAN copies traffic from one or more source ports in any VLAN or from one or more VLANs to a destination port for analysis.

Transcription:

To configure remote SPAN, we need to complete configuration on both switch 1 and switch 2. Now there’s a bug in packet tracer I have to use 2950 switches for this SPANlab as some of the other switches in packet tracer don’t support SPAN.

This specific switch in this version doesn’t change the font size of the CLI. So even though I’ve changed the font, the font size shown on these switches is very small. So I’ll have to zoom in on the video so that you can see the configuration that I’m doing. So my apologies for that, that’s a bug in packet tracer.

On switch 1 show | include monitor
no monitoring commands are configured.

show monitor
we’re told that no SPAN configuration is present in the system. So what we’re going to do is configure a monitor session, pick a number, I’m going to pick 1, source is going to be interface, Fast/Ethernet 0/1 and I can specify whether I want to copy traffic received on that port transmit on that port or both. So I’m going to specify both.

So do show monitor
At the moment, traffic sent and received on this port is going to be copied to the same session number. In this case the destination is going to be a remote VLAN 99 in this example and we need a reflector port to copy the traffic, and in this case I’ll use a FastEthernet 0/23.

So show run | include monitor
there’s our configuration. I don’t have a device connected to port 23. So that’s the port that I’m going to use to copy the frames into VLAN 99........

[idcjwys]

Great David
I suggest that you can add real projects in the graded networks on your site
And you can add decussion forum for each project to enable group interactive learning
Also in the future you can add support for different languages ​​such as Arabic
This is Just a personal view