How capture traffic in NAM 2220

[Daniel Ordóñez Flores]

Hello everyone.

Thanks for read me again. I'm in a big big problem here last week I openned a Disccussion about how configure my NAM 2220. Right now I have network connectivity but I don't know what comes next. I never "touch" before a NAM or any analyzer so I kind of loss. If someone can help me with this would be great.

Thanks you so much.

[AFROJ AHMAD]

Hi Daniel,

After the Intial setup of NAM ,  you need to configure :

SPAN / RSPAN /VACL-based captures, NetFlow (versions 1, 5, 6, 7, 8, and 9) to capture the traffic.

How to create SPAN:

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_appliance/5-0/2220/instcfg2220/config.html#wp1079309

after configuring the above , you can monitor the traffic via GUI , check the below link for that :

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_software/5-1_2/user/guide/NAM_UG512/monitr_analysis.html

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

[Daniel Ordóñez Flores]

Dear AFROJ

Thank so much for your replay but I have some question I guess easy for you, but very difficult for me.

1.- My NAM 2220 has 2 ports 10 GE XFP, only in this ports can I capture the traffic?

2.- My neighbor Switch need to has 10 GE Ethernet too?

3.- For create a SPAN can I do this in my Switch? Or I need to configure this in my NAM.

I really appreciate your help, because my job depends of this.

I hope don't bother you If I we continue in "touch"

[AFROJ AHMAD · Accepted solution]

Hi Daniel,

1. yes these  2 are your destination ports where you can capture the traffic

2. ASAIK , it is not nessacary to have 10 GE ethernet port on neighbor port

3.Yes ,SPAN configuration need to be done on the switch , which can done from GUI of the NAM too as well.

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_software/5-1/user/guide/nam51_ug/setup.html#wp1087884

https://supportforums.cisco.com/docs/DOC-32763

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

[Daniel Ordóñez Flores]

Dear AFROJ,

But I have this question if my monitoring port are 2 XPF 10 GE, my Switch port need to have an SFP port too?

[AFROJ AHMAD · Accepted solution]

that does not matter, while configuring SPAN you can give any interfcae or interfaces as source but you destination port should be ONE of the NAM Monitoring port.

****the destination port has to be configured as a monitor port and not as an access port.

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

[Daniel Ordóñez Flores]

Ok let me see if I get this right.

The NAM 2220 has two monitoring Port this ports are two 10 GE and they use fibers. My neighbor Switch (In this case a Nexus 7000) can use an SFP 1 Ge. But the medium need to be fibers right? Or I'm missing something?

What happens if my Switch doesn't have Fibers Ports? Still can I monitoring?

[AFROJ AHMAD]

I found this link , looks like we need the correct SFP:

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_appliance/2220/installation/guide/instcfg/cables.html#wp1017093

I'll check ,if I found any other relevant information . I will share it with you.

Thanks-
Afroz
[Do rate the useful post]

[Daniel Ordóñez Flores]

Dear AFROJ

Thanks for the link. Maybe my english is not good enough, but I want to discover this.

The phisycal connection beetwen my Switch CORE or (NEXUS) & NAM 2220 must be by fibers... right?

I'm not sure if I clear, if doesn't I apologyze, but I want to know if I want to capture traffic I need this connetion.

I can't capture traffic by the management port, isn`t?

Ah for last.... I need to configure this in my switch, right?

Destination port configuration

switch7000-1#configure terminal

switch7000-1(config)#interface ethernet 3/48

!--- Configures the switchport parameters for a port.

switch7000-1(config-if)#switchport

!--- Configures the switchport interface as a SPAN destination.

switch7000-1(config-if)#switchport monitor

switch7000-1(config-if)#no shut

switch7000-1(config-if)#exit

SPAN session configuration

switch7000-1(config)#monitor session 1
!---Configure the source port with traffic direction.
switch7000-1(config-monitor)#source interface ethernet 3/11 both
!--- Configure the destination port.
switch7000-1(config-monitor)#destination interface ethernet 3/48
!--- To enable the SPAN session, by default session in shutdown state.
switch7000-1(config-monitor)#no shut
switch7000-1(config-monitor)#exit
!--- To save the configurations in the device.
switch7000-1(config)#copy running-config startup-config

The destination port should be the port that is connect to my NAM?

And the source port (ports) should be the ports that is connect to my LAN?

[AFROJ AHMAD]

Hi Daniel,

The phisycal connection beetwen my Switch CORE or (NEXUS) & NAM 2220 must be by fibers . Yes

I can't capture traffic by the management port, isn`t ? >> it can only be by the Monitoring port.

Switch configuration looks fine.

The destination port should be the port that is connect to my NAM? correct

And the source port (ports) should be the ports that is connect to my LAN? cource port can be any port on the switch , the interface you want to monitor.

****** If someone has a differnt view on this ,please share with us **********

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

[Daniel Ordóñez Flores]

Dear AFROJ

I connected my Switch with GLC-SX-MMD to my NAM and I try with other 6500. But I don't see any activity on my monitor ports. The led are off. Do you know If I'm using the correct sfp for my Switches?

[Daniel Ordóñez Flores]

An another question.

If just plug in the fibers I have to see activity on my monitoring port? Or before I need to configure the SPAN Port & ans SPAN session?

[AFROJ AHMAD]

http://www.cisco.com/c/en/us/td/docs/net_mgmt/network_analysis_module_appliance/2220/installation/guide/instcfg/cables.html#wp1017093

chekc ,if you are using the supported SFP.

activity should be after configuring SPAN.

Thanks-
Afroz
[Do rate the useful post]
****Ratings Encourages Contributors ****

[Daniel Ordóñez Flores]

Maybe that is my mistake.

Because I'm connected to the nam by Management port in my PC. No network conectivity for now, and when connected my monitor to my switch nothing happens and I didn't configure the span session in my Switch.

Just another question; Can I just configure the SPAN session and ports on the Switch? Or OI need to configure in both devices?.

[AFROJ AHMAD]

You need to do the configuration on the Switch Only.

Thanks-
Afroz