Cisco and Nortel SPAN port

nickehunt · ‎07-23-2008

Ok, not sure if anyone here can help, but I am really against a wall here. I have an environment that is mostly Nortel switches, but I have a requirement to setup some IDS equipment (Cisco IDS) but cannot setup a SPAN port to capture all the traffic going across the Nortel equipment since they only allow you to monitor a limited number of ports via port mirroring. My question to the group is this. If I introduce a cisco switch to the Nortel environment and trunk all the VLAN's to the cisco switch via 802.1q, can I setup the SPAN on the cisco switch for a VLAN in the environment and capture all traffic going across the VLAN. I know you can do this in a Cisco infrastructure, but not sure if I setup the SPAN port on a cisco switch in a nortel environment if it will work the same. If anyone can help I would really appreciate it.

Thanks

Nick

wimccall · ‎07-23-2008

I really don't see that this would work. At the end of the day, the Nortel devices are going to switch the traffic (thus not forwarding traffic to other ports when the CAM has an entry for a given port). Trunking is no different except that we can send multiple VLANS over the trunk (there are still CAM entries that point MACs to that trunk interface)

With the SPAN feature you're talking about, we'd be talking about implementing RSPAN (because traffic that terminates at one switch will utilize that switch's ports and do its switching like we would expect). Since we don't have the luxury of working with RSPAN, this isn't viable either.

I'm voting no on this given my understanding of the matter.

For source reference, http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/configuration/guide/swspan.html and http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a0080883ca2.shtml

HTH

--William