×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Can IDSM perform RSPAN on Cat4K?

Unanswered Question
Apr 22nd, 2002
User Badges:

Hi, the scenario is I wish to span the traffic going through the port on one of my Cat4K in the network which is connected to a Router going to the Internet. With the installed IDSM, is it able to span the port on the Cat4K that is connected to the router?


Thanks n Regards.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
marcabal Mon, 04/22/2002 - 23:51
User Badges:
  • Cisco Employee,

Are you talking about a Cat4K or a Cat 6K?

The IDSM is only supported in the Cat6K.

IDSM= Intrusion Detection System Module for the Cat6K


If you are talking about a Cat6K with an IDSM, and the Cat6K is connected to the

router then you can span the port connected to the router to the IDSM port 1.


If you are talking about a Cat4K connected to both the Cat6K and the router then this gets very tricky. RSPAN is not supported in the Cat4K the last time I checked. I also don't recommend spanning from one switch into another because you can create bridging loops that can bring down your switches if you are not carefull.


If you are on the other hand talking about a Cat 4K with an external IDS Appliance rather than the Cat6K IDS Module then it's easy. Simply span the router port to the IDS Appliance.


laimf Wed, 04/24/2002 - 00:13
User Badges:

Yes, I'm talking about "If you are talking about a Cat4K connected to both the Cat6K and the router then this gets very tricky. RSPAN is not supported in the Cat4K the last time I checked. "


I'm considering doing that is because the external router is connected to the Cat4K, which both of them are in the same room. And then, the cat4K is linked to the Cat6K which is in a separate building. The IDSM is running in the Cat6K and that's make me wonder if I could do a rspan on the Cat4K on the Cat6k with the IDSM.


Rgd the RSPAN on Cat4K, I've come across a note on cisco web site saying the CatOS ver 5 onwards are able to do that. If doing RSPAN is not recommended, is there any other recommendation on doing that?


Your advice is very much appreciated. Thank you.

marcabal Thu, 04/25/2002 - 04:44
User Badges:
  • Cisco Employee,

According to the links that the other gentlemam posted, it looks like RSPAN is supported in version 6.3 of Cat OS for the Cat 4K.


So it looks like you should be able to set the router port on the Cat 4K as an RSPAN source port, and the IDSM port on the Cat 6K as the RSPAN destination port.


When you setup the RSPAN on the Cat 4K you will want to span both tx and rx for the router port.


I have successfully done this between 2 Cat6Ks, so now that RSPAN is supported in the Cat 4K this should work as well.


laimf Wed, 05/08/2002 - 23:58
User Badges:

Hi, thanks alot for your advice.


Before I try configuring the RSPAN on the the currently operating network. May I have your opinion on whether is it advisable to configure RPSAN and Is there any other way of monitoring the router traffic besides moving the router to the Cat6K?


Thanks & Regards,

Moh Fun.

jekrauss Wed, 04/24/2002 - 18:07
User Badges:

Yes, you can use RSPAN to capture traffic for the IDSM.


Jeff

Actions

This Discussion