SPAN Configuration in Catalyst 3750

[anylmjn111]

Hi,

I have CISCO catalyst with VLANs (VLAN ID 33, 36, 40-53) configured. I need to configure port mirroring in Switch 3750 for NAC (Network Access Control).  I need to Monitor all the VLANs. Here is the SPAN configuration of switch:

Interface fa 1/0/8

Description ******NAC-MONITOR-PORT******

Switchport trunk encapsulation dot1q

Switchport mode trunk

|

Interface fa 1/0/9

Description ******NAC-Response-PORT******

Switchport trunk encapsulation dot1q

Switchport mode trunk

Monitor session 1 source vlan 33 , 36 , 40 – 53

Monitor Session 1 destination interface fa 1/0/8  (here I am not able to set encapsulation dot1q ) because the error occurred saying %one or more dest port do not support the encapsulation%. please suggest why this error occured?

[mfarrenkopf]

It looks like you need to change the destination command to:

monitor session 1 destination interface fa1/0/8 encapsulation replicate

Otherwise, it tries to send the traffic untagged.  If you want everything that the interface is seeing, that won't work.

[anylmjn111]

i Have changed the destination command as you have suggested:

monitor session 1 destination interface fa 1/0/8 encapsulation replicate

but still i am not able to see mirror traffic from VLAN 33, 36 , 40 -53 in NAC appliance. All the traffic is seen as untagged.

[mfarrenkopf]

Have you tried hooking up a sniffer like Wireshark to capture a sample of the traffic you're seeing?  I'm wondering if the 3750 is passing the traffic tagged and the NAC is not set up correctly.

The other thought I had:  is one of those VLANs a native VLAN?  You don't show it in your config above; I wasn't sure if you abbreviated the configuration or if that's the entire config for those ports.  If you've got a native VLAN and if that native VLAN is carrying most of the traffic, you won't see tags for the majority of it.

[viswamin]

I just happened to go through the link and it suggests different ways of implemention

http://www.colasoft.com/resources/span.pdf

Not sure although if it work.

-Vijay

[David Cho]

Anyl,

was your original problem resolved?  If so, can you share the solution?

Thanks,

David