topic configure 6513 IDSM and Local SPAN failed in Network Security

configure 6513 IDSM and Local SPAN failed

lcd_shouldit — Sun, 10 Mar 2019 12:59:22 GMT

Hi, my catalyst 6513 IOS version is 12.2(18)SXF16 and 12.2(33)SXI5 , today I want to configure my IDSM module,

I should SPAN my vlan traffic to the IDSM, right?

commands like :

monitor session 4 source vlan 21

monitor session 4 destination intrusion-detection-module 10 data-port 1

But the switch tell me :

% Local Session limit has been exceeded

So, what should I do if I want my IDSM work.

Thank you !

Thulasi Shankar — Thu, 27 Jun 2013 02:18:54 GMT

Hi,

You mayuse VACLs to pass the traffic to the IDSM2. VACL capture allows you to specify whatever vlans you would like to have the IDSM2 monitor.

So if you know what vlans passing on the etherchannels, then you may include them in the VACL configuration

For Example :

intrusion-detection module 4 data-port 1 capture allowed-vlan 10-20,40,70

Please find the documentation to configure VACLs on the 6500 switch:

Hope that answers your query.

Thulasi Shankar

lcd_shouldit — Thu, 04 Jul 2013 11:55:15 GMT

Hi, Sorry for late.