topic Cisco ASA 5510 SPAN in Network Security

Cisco ASA 5510 SPAN

rbrownejr — Mon, 11 Mar 2019 21:25:29 GMT

Hi,

I'm trying to setup port mirroring on a Cisco ASA 5510, but when I try to use the switchport monitor command, that command is not recognized.

I've selected what interface I want to configure (conf-if), but the switchport command seems to not be part of the IOS.

I'm running ASA version 8.2(1)

Any ideas?

Cisco ASA 5510 SPAN

varrao — Thu, 15 Sep 2011 20:31:22 GMT

Hi Roy,

What is the command that you are using ???? You need to first create a vlan and assign the physical interface to the vlan with the switchport command, for further details refer this doc:

http://www.cisco.com/en/US/partner/docs/security/asa/asa82/command/reference/i3.html#wp1874313

Let me know if you have any questions.

Hope this helps.

Thanks,

Varun

Please do rate helpful posts.

Cisco ASA 5510 SPAN

varrao — Thu, 15 Sep 2011 20:35:05 GMT

You can also refer this:

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/int5505.pdf

-Varun

Cisco ASA 5510 SPAN

rbrownejr — Thu, 15 Sep 2011 20:45:51 GMT

Thanks Varun,

Please see the below. This is the output I get when I try to configure the interface. The switchport command is not even being recognized.

colo-firewall# conf term

colo-firewall(config)# interface Ethernet 0/3

colo-firewall(config-if)# switchport ?

ERROR: % Unrecognized command

Cisco ASA 5510 SPAN

varrao — Thu, 15 Sep 2011 21:03:49 GMT

Hi Roy,

What license are you using, I am not sure but switchport command is supported for security plus license only.

Thanks,

Varun

Cisco ASA 5510 SPAN

rbrownejr — Thu, 15 Sep 2011 21:31:10 GMT

We have the Security Plus license. The firewall is configured in an Active/Standby setup.

Don't know if that makes a difference.

Thanks,

Roy

Cisco ASA 5510 SPAN

varrao — Thu, 15 Sep 2011 21:35:05 GMT

Hi Rob,

Can you provide the output of:

show version

show run interface

show run nameif

show vlan

Thanks,

Varun

Re: Cisco ASA 5510 SPAN

rbrownejr — Thu, 15 Sep 2011 21:41:32 GMT

Hi Varun,

Please see below.

Thanks

show version:

Cisco Adaptive Security Appliance Software Version 8.2(1)

Device Manager Version 6.2(1)

Compiled on Tue 05-May-09 22:45 by builders

System image file is "disk0:/asa821-k8.bin"

Config file at boot was "startup-config"

colo-firewall up 1 day 4 hours

failover cluster up 125 days 14 hours

Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz

Internal ATA Compact Flash, 256MB

BIOS Flash Firmware Hub @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)

Boot microcode : CN1000-MC-BOOT-2.00

SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03

IPSec microcode : CNlite-MC-IPSECm-MAIN-2.04

0: Ext: Ethernet0/0 : address is f866.f2fd.18d0, irq 9

1: Ext: Ethernet0/1 : address is f866.f2fd.18d1, irq 9

2: Ext: Ethernet0/2 : address is f866.f2fd.18d2, irq 9

3: Ext: Ethernet0/3 : address is f866.f2fd.18d3, irq 9

4: Ext: Management0/0 : address is f866.f2fd.18d4, irq 11

5: Int: Not used : irq 11

6: Int: Not used : irq 5

Licensed features for this platform:

Maximum Physical Interfaces : Unlimited

Maximum VLANs : 100

Inside Hosts : Unlimited

Failover : Active/Active

VPN-DES : Enabled

VPN-3DES-AES : Enabled

Security Contexts : 2

GTP/GPRS : Disabled

SSL VPN Peers : 2

Total VPN Peers : 250

Shared License : Disabled

AnyConnect for Mobile : Disabled

AnyConnect for Linksys phone : Disabled

AnyConnect Essentials : Disabled

Advanced Endpoint Assessment : Disabled

UC Phone Proxy Sessions : 2

Total UC Proxy Sessions : 2

Botnet Traffic Filter : Disabled

This platform has an ASA 5510 Security Plus license.

show run nameif:

interface Ethernet0/0

nameif outside

security-level 0

interface Ethernet0/1

nameif inside

security-level 99

interface Ethernet0/3

nameif testing

security-level 0

interface Management0/0

nameif management

security-level 100

show vlan:

I don't currently have any vlans setup.

show run interface:

interface Ethernet0/0

speed 100

duplex full

nameif outside

security-level 0

ip address X.X.X.X 255.255.255.0 standby X.X.X.X

interface Ethernet0/1

duplex full

nameif inside

security-level 99

ip address 10.2.1.1 255.255.255.0 standby 10.2.1.2

interface Ethernet0/2

description LAN/STATE Failover Interface

interface Ethernet0/3

nameif testing

security-level 0

ip address 192.168.2.1 255.255.255.0

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

Cisco ASA 5510 SPAN

varrao — Thu, 15 Sep 2011 21:46:11 GMT

No it would not work, you need to do this:

int eth0/3

no ip address

no nameif

no security-level

int vlan 2

nameif testing

ip address 192.168.2.1 255.255.255.0

no shut

int eth0/3

switchport access vlan 2

no shut

Thats how it works.

Hope this helps.

Thanks,

Varun

Re: Cisco ASA 5510 SPAN

rbrownejr — Fri, 16 Sep 2011 13:51:11 GMT

Hi Varun,

Thanks for your help. After doing some more research it appears that this can be setup on the 5505, but not the 5510.

Thanks,

Roy