Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Configure IDSM with RSPAN

Hi

We have here two 6509 switches with an IDSM blade in each one.

I want one of them to monitor a remote port on a remote switch.

But I can not see traffic on the IEV.

That is the configuration I used:

We have a pre configured RSPAN vlan (555) on our VTP servers.

1. on the remote switch:

monitor session 2 source interface Gi6/37

monitor session 2 destination remote vlan 555

2. on the 6509:

monitor session 2 source remote vlan 555

monitor session 2 destination intrusion-detection-module 2 data-port 2

3. on the IEV:

made a new filter with the scope of addresses used on that network.

made a new view using the filter I made.

If I forgot something tell me...

Thank You!!

1 REPLY
Cisco Employee

Re: Configure IDSM with RSPAN

Not my area of expertise (RSPAN), but did you set up the IDSM2 ports to allow the proper vlans? This would be a switch config item, not an IPS config item.

Also, if you are running IPS 5 or 6, you can use the "packet" command to display what the IPS sensor is seeing on its sensing ports. Its a good way to see that your traffic is getting to the sensor.

Scott

153
Views
0
Helpful
1
Replies