Cisco IPS 4255 Monitoring mode issue

craig.corbett · ‎06-18-2012

Hi all,

We have a Cisco IPS device in monitoring mode, monitoring 2 segments of traffic via spanned ports on two different 3750-x switches (inside and DMZ). After a period of say 2-3 hours the ports just stop passing traffic to the IPS device. To check there still is traffic we have a laptop connected on another port running wireshark and the port connected to the laptop never fails. I need to remove and re-add the span port config in order for the traffic to start flowing to our Cisco IPS again. I am not able to see in your syslog and reason for this.

Any comments / suggestions greatly appreciated.

Thanks.

craig.corbett · ‎06-18-2012

These are the commands I need to issue with the device stops receiving packets from the spanned ports:

no monitor session 1 source interface Gi1/0/24 both
no monitor session 1 destination interface Gi1/0/1

monitor session 1 source interface Gi1/0/24 both
monitor session 1 destination interface Gi1/0/1

Thanks.

Karsten Iwen · ‎06-19-2012

what is the config of the destination-port Gi1/0/1?

Sent from Cisco Technical Support iPad App

craig.corbett · ‎06-20-2012

The only config is port fast. No vlan no trunk, no switch port config etc.

Thanks.