Configuring 4255 sensor in promiscuous mode

Colin Higgins — Sun, 10 Mar 2019 13:10:13 GMT

I have a 4255 with 3 interfaces that connect to a 6500 series switch. The IPS interfaces are set to promiscuous mode with a defualt vlan specified.

On the switch side, I would like to send the traffic from more than one vlan to the sensor GE interfaces. What is the best way to do this?

Do I set up a monitor session on the switch with a source of multiple vlans, then set the destination as one of the sensor ports?

I also see the option to do a switchport capture.

Any advice would be great

You want to do a VACL capture

rhermes — Wed, 02 Apr 2014 22:52:30 GMT

You want to do a VACL capture on the 6500:

http://www.cisco.com/c/en/us/support/docs/lan-switching/vlan-access-lists-vacls/89962-vacl-capture.html

monitor session 50 source vlan  100 , 200

monitor session 50 destination  interface Fa3/30