More than one monitor session on 6513

corey.mckinney · ‎04-23-2009

I'm trying to setup (2) monitor sessions on our 6513. One to span voice VLANs for HigherGround recording, and the other to span Internet traffic for Websense filtering.

Here is what I have so far:

monitor session 1 source vlan 4 , 42

monitor session 1 destination Gi6/15

That is for the HigherGround recording and it is working fine.

The problem comes when I try to add a second monitor session. If I type in "monitor session x source interface g6/2", I get an error saying "Local Session limit has been exceeded".

Is there a way to create 2 monitor sessions?

tstanik · ‎04-29-2009

Error "% Local Session Limit Has Been Exceeded" This message appears when the allowed SPAN session exceeds the limit for the Supervisor Engine. Supervisor Engines have a limitation of SPAN sessions.

niro · ‎04-29-2009

Do you have a FWSM? the 6500's have a monitor session running to forward multicast traffic to the FWSM which takes up one of the two sessions (limit is two), if you don't need this you can disable it.

The best way for you to do this is to set up the one span session with two destination ports. Then filter out the vlan on the destination port with the switchport trunk allowed vlan x command.

You can't source a vlan and an interface in a single session...if you do require sourcing an interface instead of a vlan then you'd either have to disable the service monitor session or use a network tap for the websense server instead of a span session.

glen.grant · ‎04-29-2009

Whats a show monitor tell you ?

JamesLuther · ‎04-30-2009

Hi,

If you've run out of SPAN sessions then you can use VACLs to capture traffic. See this document

http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808122ac.shtml#conf

It's more complex to setup but more flexible

Regards