IPS 4240 on IDS - SPAN issue

[J_Vansen_S]

Device: IPS 4240

MOde: all 4 interfaces on Promiscuous

Objective: To monitor 4 different vlans namely vlan 10,20,30,40 across the network.

There are 8 switches on my network with vlan 10 - 40 info (vtp trunk)

How do i configure SPAN on VLANs that exist on all my access switches

I tried configuring on the access switch where the IPS interfaces are connected to.

monitor session 1 source vlan 10 , 20 , 30, 40

monitor session 1 destination interface Gi0/1 - 4

Did a mass ping from vlan 10 to its gateway

Checked my IPS interfaces status, i seem to be receiving packets on all 4 interfaces. Shouldnt i be receiving packets on the correct IPS interfaces that the vlan is destined?

Please advise

[dhananjoy chowdhury]

monitor session 1 source vlan 10 , 20 , 30, 40

monitor session 1 destination interface Gi0/1

The above commands will span the traffic (tx/rx) traffic in ALL the vlans 10,20,30,40 , but this will be limited to traffic only the switch on which this is configured.

For getting traffic in the same vlans but on other switches, you will have to configure RSPAN.

Refer to this link for more details.

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml