Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

IPS 4240 on IDS - SPAN issue

Device: IPS 4240

MOde: all 4 interfaces on Promiscuous

Objective: To monitor 4 different vlans namely vlan 10,20,30,40 across the network.

There are 8 switches on my network with vlan 10 - 40 info (vtp trunk)

How do i configure SPAN on VLANs that exist on all my access switches

I tried configuring on the access switch where the IPS interfaces are connected to.

monitor session 1 source vlan 10 , 20 , 30, 40

monitor session 1 destination interface Gi0/1 - 4

Did a mass ping from vlan 10 to its gateway

Checked my IPS interfaces status, i seem to be receiving packets on all 4 interfaces. Shouldnt i be receiving packets on the correct IPS interfaces that the vlan is destined?

Please advise

1 REPLY

Re: IPS 4240 on IDS - SPAN issue

monitor session 1 source vlan 10 , 20 , 30, 40

monitor session 1 destination interface Gi0/1

The above commands will span the traffic (tx/rx) traffic in ALL the vlans 10,20,30,40 , but this will be limited to traffic only the switch on which this is configured.

For getting traffic in the same vlans but on other switches, you will have to configure RSPAN.

Refer to this link for more details.

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml

169
Views
0
Helpful
1
Replies
CreatePlease to create content