I'm configuring an Alienvault Unified Security Management (USM) unit and one of the requirements is setting up a SPAN port. The USM will be connected to a Cisco 3560X that is in the core of my network.
I'm planning to configure a RSPAN session to capture the traffic from all the switches in the rest of the network. But I'm not sure whether I have to configure a separate SPAN session for the local traffic of the interfaces in the 3560X.
So I believe I need a RSPAN session for the traffic from all remote switches and a SPAN session for the local traffic.
I can't configure an interface to be the destination for more than one SPAN session, so this means I have to have to separate destination ports.
If someone can confirm that I'm making the right assumptions here, I'd greatly appreciate it.