MSFC

[niglio]

Hi,

it has been placed in an IDC a Catalyst switch 6509 with MSFC. Actually i wonder if a switch port is used to forward traffic to the MSFC and if traffic going to MSFC is tagged in anyway...

Thanks

[m.singer]

Yes, the virtual switched port 15/1 for the MSFC in slot1 and 16/1 for the MSFC in slot 2 is used.

[marcabal]

Mostly correct.

From the user's perspective this is mostly true. But if you start using Span you might notice some weird things.

When a connection is initially made between 2 machines that must be routed through the MSFC, the first few packets of the connection do go through either port 15/1 or 16/1.

But, once the connection has been established then MLS (multi-layer switching) kicks in and starts doing fast switching in hardware for that connection. The Supervisor recognizes that the MSFC is permitting and routing that conection so instead of sending additional packets for that connection to the MSFC it sends it to the PFC (policy feature card) which switches/routes these already permitted connections in hardware. This allows the switch to route packets at the speed of the backplane (in the case of the new fabric, the DFCs - Distributed Forwarding Cards - aid the PFC in doing this hardware switching/routing.)

So if you Span 15/1 (or 16/1) you may only see the initial packets for the connections. The other packets are going through the PFC (or DFCs) which do not have spannable "ports".

So instead of Spanning the MSFC port 15/1 (or 16/1) you need to span either the port where the packets enter the switch or the port where they leave the switch.

Marco

[AlelA]

My problem is quite similar...

I have defined a primary pvlan where the MSFC (on cat 6509) is connected through a promiscuos port and several community pvlan to connect the servers of the clients (on cat 6513).

I thought to SPAN (VSPAN) the entire PRIMARY PVLAN to see all the traffic flowing to the servers. Is it ok?

All the switches are connected by Trunk carring all the pvlans. Can I define the destination SPAN port in every of the switch where the PRIMARY PVLAN is defined and see the same traffic mirrored?

Thanks

Ale

[marcabal]

I am not sure how Span will interact with private vlans.

Cisco TAC would be the best source of information.

My guess would be that you would want to span the actual server ports themselves (both "tx" and "rx") rather than the vlans, at that might help avoid the issues that private vlans cause.

If using multiple switches you probably want a separate sensor for each switch, monitoring the server ports on that switch.

But once again the TAC would be the best source of information because I've never dealt with private vlans.

[niglio]

Inorder to understand better:

the MSFC permits the connection and routes the packet. As the Supervisor reconizes this procedure is active, give the permission to MLS to do fast switching in hardware for that connection... so i don't understant the different actions that MLS and PFC has to do?.. it seems as they do the same thing...

Thanks