Remote Port Mirroring for Passive VoIP Call Recordings

We need to capture VoIP traffic - including both inbound and outbound RTP streams - from dedicated IP phones for delivery to the Call Recording server. These IP phones are distributed across various remote switches within the Layer 2 Ethernet network. By configuring RSPAN (Remote Switched Port Analyzer), we can mirror the VoIP traffic from these remote switches to a destination switch that is directly connected to the Call Recorder.

 Network diagram:

RSPAN configuration

We are using Edge-Core ECS4100 series switches, which feature a Cisco-like command-line interface (CLI).

Source switch 1

Create VLAN 100 for RSPAN traffic:

vlan database
 VLAN 1 name DefaultVlan media ethernet
 VLAN 100 media ethernet rspan

Create RSPAN session 1 with Source and Remote ports:

rspan session 1 source interface ethernet 1/2 both
rspan session 1 remote vlan 100 source uplink ethernet 1/25

Both transmit (TX) and receive (RX) traffic on port 2 will be mirrored to uplink port 25 via VLAN 100.

Show RSPAN configuration: 

sw-1#sh rspan session 1
RSPAN Session ID                : 1
Source Ports (mirrored ports)
  RX Only                       : None
  TX Only                       : None
  BOTH                          : Eth 1/2
Destination Port (monitor port) : None
Destination Tagged Mode         : None
Switch Role                     : Source
RSPAN VLAN                      : 100
RSPAN Uplink Ports              : Eth 1/25
Operation Status                : Up

Source switch 2

The same configuration on the second Source switch for port 3 and uplink port 26:

rspan session 1 source interface ethernet 1/3 both
rspan session 1 remote vlan 100 source uplink ethernet 1/26

Intermediate switch

Configure RSPAN session 1 on the intermediate switch with VLAN 100, specifying all uplink ports.

rspan session 1 remote vlan 100 intermediate uplink ethernet 1/25,26,28

Show RSPAN configuration: 

sw-3#sh rspan session 1
RSPAN Session ID                : 1
Source Ports (mirrored ports)   : None
  RX Only                       : None
  TX Only                       : None
  BOTH                          : None
Destination Port (monitor port) : None
Destination Tagged Mode         : None
Switch Role                     : Intermediate
RSPAN VLAN                      : 100
RSPAN Uplink Ports              : Eth 1/25, 1/26, 1/28
Operation Status                : Up 

Unfortunately, we cannot configure source ports for mirroring on the switch serving the intermediate role. A single port cannot be used as an uplink in multiple RSPAN sessions. Therefore, all IP phones intended for remote port mirroring must be connected to switches designated with the source role. 

Destination switch

rspan session 1 destination interface ethernet 1/1

rspan session 1 remote vlan 100 destination uplink ethernet 1/22  

We can now remotely capture all traffic from the IP phones connected to the source ports on Switches 1 and 2. This mirrored traffic is delivered to the destination switch, enabling the recording of VoIP calls.