User's Manual

70-1
Chapter 70 RSPAN Configuration
70.1 Introduction to RSPAN
Port mirroring refers to the duplication of data frames sent/received on a port to another port. The duplicated
port is referred to as mirror source port and the duplicating port is referred to as mirror destination port. It is
more convenience for network administrator to monitor and manage the network and diagnostic after the
mirroring function achieved. But it only used for such instance that the mirror source port and the mirror
destination ports are located in the same switch.
RSPAN (remote switched port analyzer) refers to remote port mirroring. It eliminates the limitation that the
source port and the destination port must be located on the same switch. This feature makes it possible for
the source port and the destination port to be located on different devices in the network, and facilitates the
network administrator to manage remote switches. It can’t forward traffic flows on remote mirror VLAN.
There are three types of switches with the RSPAN enabled:
1. Source switch: The switch to which the monitored port belongs. The source switch copies the mirrored
traffic flows to the Remote VLAN, and then through Layer 2 forwarding, the mirrored flows are sent to
an intermediate switch or destination switch.
2. Intermediate switch: Switches between the source switch and destination switch on the network.
Intermediate switch forwards mirrored flows to the next intermediate switch or the destination switch.
Circumstances can occur where no intermediate switch is present, if a direct connection exists
between the source and destination switches.
3. Destination switch: The switch to which the destination port for remote mirroring belongs. It forwards
mirrored flows it received from the Remote VLAN to the monitoring device through the destination
port.
When configuring the RSPAN mirroring of the source switch, reflector port mode or destination mirror port
mode can be selected. The destination switch will redirect all the data frames in the RSPAN VLAN to the
RSPAN destination port. For RSPAN mirroring, normal mode and advanced mode can be chosen, normal is
introduced by default and fit the normal user. The advanced mode fit the advanced user.
1. Advanced mode: To redirect data frames in RSPAN VLAN to the RSPAN destination port, the
intermediary and destination devices should support the redirection of flow.
2. Normal mode: To configure the RSPAN destination port in the RSPAN VLAN. Thus, datagrams in the
RSPAN VLAN will be broadcasted to the destination port. In this mode, the destination port should be
in RSPAN VLAN, and the source port should not be configured for broadcasting storm control.
TRUNK ports should be configured carefully in order not to forward RSPAN datagrams to external
networks. The normal mode has the benefit of easy configuration, and reduced system resources.
To be noticed: Normal mode is introduced by default. When using the normal mode, datagrams with reserved
MAC addresses cannot be broadcasted.