SPAN CONFIGURATION

wasiimcisco · ‎02-26-2008

I have IPS 5.x in promiscous mode. I wanted to configure my catalyst switch 3750 so that It can monitor not only ports but also few VLAN that on the same switch.

monitor session 1 source interface Gi1/0/1 , Gi1/0/10

monitor session 1 destination interface Gi1/0/5

It is working fine with the interface level configuration. But when i try to configure the monitor session for the VLAN it gave me error.

monitor session 1 source vlan 333

% Cannot add VLANs as sources for SPAN session 1

Why it is so, Can a same port can be act as destination for more than one session.

ciscograyaw · ‎02-26-2008

A monitor session can source from interfaces or VLANs - not both at the same time.

A destination port can only be used by one monitor session at a time.

wasiimcisco · ‎02-26-2008

Thanks for the reply,

I have configured my two vlans as source in monitor session and on switch in which my IPS is connected is configured as destination port.

My these two vlans has ip addresses. Kindly tell me now i will be able to monitor all ports in these two vlans or only traffic destinated towards the Ip addresses of these interface vlans will be monitored.

Kindly help me out

ciscograyaw · ‎02-26-2008

You can configure VLAN filtering on your SPAN sessions if that is what you are wanting:

monitor session 1 source interface Gi1/0/1 , Gi1/0/10

monitor session 1 filter vlan 333

monitor session 1 destination interface Gi1/0/5