Remote Switched Port Analyzer (RSPAN) functions by encapsulating mirrored traffic into a dedicated VLAN to transport it between switches. The best practice is to create and use a VLAN exclusively for this RSPAN traffic. This isolates the potentially high-volume mirrored data from regular production traffic, preventing network congestion, performance degradation on user VLANs, and security complications. This dedicated VLAN is then trunked between the source, transit, and destination switches to deliver the mirrored packets to the monitoring device.

A. Use the same VLAN already configured for regular data traffic.

This is incorrect because mixing high-volume mirrored traffic with production data can cause network congestion and performance issues for users on that VLAN.

C. Use a dynamic VLAN that includes all switch ports.

This is a severe misconfiguration. Including all switch ports would unnecessarily flood the entire network with mirrored traffic, causing a broadcast storm and network outage.

D. Use the RSPAN VLAN as a native VLAN on all trunk ports.

This is incorrect. The RSPAN VLAN carries tagged traffic across trunks. Designating it as the native VLAN is for untagged traffic and is not the standard or recommended RSPAN configuration.

---

1. FortiSwitch OS 7.4.0 Administration Guide, Page 168, "Port mirroring" section.

The documentation explicitly states: "RSPAN uses a dedicated VLAN to transport the mirrored traffic between the switches." This directly supports the use of a dedicated VLAN (Answer B) and contradicts using an existing data VLAN (Answer A).

2. FortiSwitch OS 7.4.0 Administration Guide, Page 169, "Configuring RSPAN" section.

The configuration example demonstrates creating a new, dedicated VLAN for RSPAN: config system interface, edit "rspanvlan", set vlanid , set remote-span enable. This procedure confirms that the standard method is to create a new, dedicated VLAN for this purpose.