Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2Network AssuranceMedium
A network engineer wants to implement RSPAN to monitor traffic flowing between two switches, SwitchA and SwitchB, located in different wiring closets. The monitoring station is connected to SwitchC. Which of the following is a mandatory requirement for RSPAN to function correctly across multiple switches?
- AThe monitoring station must be directly connected to SwitchA or SwitchB.
- BAll switches must be configured with a dedicated RSPAN VLAN.
- CThe RSPAN source port must be a trunk port.
- DSwitchC must support ERSPAN.
Show answer & explanationAnswer & explanation
Correct answer: B. All switches must be configured with a dedicated RSPAN VLAN.
RSPAN requires a dedicated RSPAN VLAN that is propagated across all switches involved in the RSPAN session. This VLAN is used to carry the mirrored traffic between the source switch(es) and the destination switch, maintaining the original VLAN tags of the mirrored traffic.
Why the other options are wrong
- A. The monitoring station can be connected to any switch in the RSPAN domain, as long as that switch is part of the RSPAN VLAN configuration and is designated as the RSPAN destination.
- C. RSPAN source ports can be access or trunk ports; the type of port does not dictate the RSPAN functionality itself, though a trunk port might be a source if mirroring multiple VLANs.
- D. ERSPAN is a different technology (Encapsulated RSPAN) used for Layer 3 tunneling; RSPAN does not require it.
Remote SPAN (RSPAN)
A Cisco feature that allows mirroring traffic from source ports or VLANs on one switch to a destination port on a different switch.
- Requires a dedicated RSPAN VLAN.
- Mirrored traffic is carried over the RSPAN VLAN.
- Operates at Layer 2.
Memory trick: SPAN is local, RSPAN uses VLANs to cross, ERSPAN tunnels far, never at a loss.